nehelper - incoming connections

[mac_ilogic]

Ive just started getting incoming connections from nehelper on my iMac, OSX 10.13.6. I have Little Snitch set to deny them.

Coming from 194.35.233.12 and 81.92.203.116.

Puzzled because there is no reference to nehelper on here and nothing at all on an internet search.

Im not massively concerned as it seems to be a Mac executive process but it seems totally odd it coming from outside.

Does anybody have any clues?

 

[Cory Cooper]

Hello and welcome.

nehelper seems to be part of macOS and is located in /usr/libexec/nehelper. I am not familiar with it or what it does, but it is present and running on my new M1 Mac mini running macOS 11.2.3 Big Sur, which doesn't have a lot of software installed on it yet.

WHOIS results:
194.35.233.12 - NordVPN from Panama
81.92.203.116 - M247 Ltd from Manchester UK

I think you are porobably good with having LittleSnitch deny them. Let us know if you see/hear anything else about them.

C

 

[mac_ilogic]

Hey that is really useful thanks. I think you have explained it. I have a NordVPN VPN and it looks like M247 also supply VPN services. So I conclude the connection requests are part of my VPN. Why connecting in from external though Im not sure, seems odd. As you say nehelper runs inside the computer so it shouldnt need to make incoming connections. Denying the connections does not seem to affect the VPN operation so they dont seem essential. Will update if anything else comes up. Thanks for your help.

 

[Cory Cooper]

No worries...glad that helped.

Stay healthy and safe!

C

 

[WaltDittrich]

So interesting... I read this was part of MacOS and therefore allowed it access. However, Cory says you can safely block it.
It's safe, but block it. ‍