Run these commands on the machine running XIVLauncher to allow incoming connections on the specified port.
UFW
sudo ufw allow from localhost to any port 4646 proto tcp
iptables
sudo iptables -I INPUT -p tcp -s localhost --dport 4646 -j ACCEPT
Windows (PowerShell)
New-NetFirewallRule -DisplayName "XIVLauncher OTP" -Direction Inbound -RemoteAddress localhost -LocalPort 4646 -Protocol TCP -Action Allow