Firefox remote debugging server: restricting which hosts may connect to the debugger port

Answer

Firefox does not provide a built‑in preference or command‑line flag that accepts an IP‑allowlist or origin filter for the remote debugger server. You can, however, bind the debugger to a single interface (e.g., localhost) so that only connections from that interface are accepted. If you need to allow a small set of specific hosts while keeping the configuration inside a reproducible profile, run a lightweight TCP proxy that performs the allow‑list check and forwards approved traffic to the Firefox debugger port.

Confirmed facts

• There is no preference for an IP‑allowlist or origin‑based restriction on the debugger server.
• The preference devtools.debugger.remote-host (or the command‑line form --start-debugger-server :) controls the interface on which the debugger listener binds.
• Setting this preference to 127.0.0.1 (or using --start-debugger-server 127.0.0.1:6000) makes the listener reachable only from the local machine.
• A simple TCP proxy (e.g., socat, nc, or a minimal Node/Go program) can listen on 0.0.0.0:6001, check the source IP against an allow‑list, and forward approved connections to 127.0.0.1:6000 where Firefox is bound.

Steps for a localhost‑only setup (repeatable via profile)

1. Create or edit a Firefox profile and set the preference:

   user_pref("devtools.debugger.remote-host", "127.0.0.1");
   

2. Enable remote debugging:

   user_pref("devtools.debugger.remote-enabled", true);
   

3. Start Firefox with the desired port (the port is given separately):

   firefox -P <profile-name> --start-debugger-server 6000
   

4. Verify the binding:

   ss -ltnp | grep 6000
   

   You should see 127.0.0.1:6000 in the output.
5. Test from another machine; the connection should be refused or timeout.

Steps for a limited‑host allowlist (using a proxy)

1. Bind Firefox to localhost as above (preference 127.0.0.1).
2. Launch a proxy that performs IP filtering. Example with socat:

   socat TCP-LISTEN:6001,reuseaddr,fork SYSTEM:\"if [ \\$SOCAT_PEERADDR = 10.0.0.5 ] || [ \\$SOCAT_PEERADDR = 10.0.0.6 ]; then exec socat STDIO TCP:127.0.0.1:6000; else exit 1; fi\"
   

   This example allows only 10.0.0.5 and 10.0.0.6 to reach the debugger.
3. Start Firefox as before (listening on 127.0.0.1:6000).
4. Connect clients to port 6001 on the host running the proxy; the proxy will forward only allowed IPs.
5. Check proxy logs or add simple logging to confirm which IPs were accepted or rejected.

Missing diagnostic detail

Do you need to allow connections from more than one specific host besides localhost? If the answer is “no”, the localhost‑only binding is sufficient; if “yes”, the proxy approach described above is required.