Error when setting WCF NetTcpBinding to only accept local connections

Question

I am trying to set up a WCF service which only accepts incoming messages/connection from itself.

I have been able to successfully create the service and run it and communicate with it using this code to create the WCF Endpoint (not restricted to localhost only)

NetTcpBinding binding = new NetTcpBinding();
binding.Security.Mode = SecurityMode.None;
_host = new ServiceHost(this, new Uri("net.tcp://localhost:19852"));
_host.Description.Behaviors.Add(new ServiceMetadataBehavior());
_host.AddServiceEndpoint(typeof(ISyncClient), binding, "SyncService");
_host.AddServiceEndpoint(typeof(IMetadataExchange), System.ServiceModel.Description.MetadataExchangeBindings.CreateMexTcpBinding(), "mex");
_host.Open();

As soon as I add this line to restrict to connections from localhost

binding.HostNameComparisonMode = HostNameComparisonMode.Exact;

I get this exception

System.ServiceModel.AddressAlreadyInUseException: There is already a listener on IP endpoint 0.0.0.0:19852. This could happen if there is another application already listening on this endpoint or if you have multiple service endpoints in your service host with the same IP endpoint but with incompatible binding configurations. ---> System.Net.Sockets.SocketException: Only one usage of each socket address (protocol/network address/port) is normally permitted

I'm not even sure what I am doing is the correct way to restrict WCF access, but obviously its not working. To me this looks like some sort of conflict with the MEX endpoint. As far as I know I NEED the mex endpoint so I can't get rid of it. Anyone point me in the direction of a solution?

Answer 1

The easy way to do this is with a named pipe binding. It only supports local calls. From Choosing a Transport:

When communication is required between different WCF applications on a single computer, and you want to prevent any communication from another machine, then use the named pipes transport.

Also, Mex points are completely optional. You can get rid of its endpoint and behavior without a problem.