Mac OS X (Leopard) Firewall

OS X (both Leopard and Tiger) comes with a built-in firewall that’s disabled by default. The Leopard firewall is a little bit different than Tiger’s, so I’m focusing on that. The underlying firewall is ipfw – the same as on FreeBSD, so if you know what you’re doing, you can edit it to your heart’s content. More details on controlling the firewall from the command line are available in this O’Reilly article. This article is going to talk about dealing with the firewall through the available GUI interface.

First, you have to access the firewall. System Preferences -> Security then the Firewall tab. By default, it’ll have “Allow all incoming connections”. If you’re not quite sure what you’re doing, “only allow essential services” is a good option, and OS X will control it via your “sharing” system preference. For example, if you turn on Remote login, OS X will add SSH(22) as an allowed incoming port.

The other option is “Set access for specific services and applications”, which gives you finer control over the incoming connections. For example, I can allow Adium and Skype to have incoming connections (so that people can send me messages or call me), but deny incoming connections to Microsoft Word (why does Word need incoming connections again???). While you’re using the system, if an application asks to accept connections, you will be asked if you want to allow or deny the connection. Your choices are recorded in this system preference just in case you want to change it later.

One thing OS X’s firewall supports (through the command line, but not the GUI) but doesn’t give you easy access to is outbound filtering. If you aren’t familiar with ipfw, and want outbound filtering, I highly recommend Little Snitch. It’s not free, but it’s $30 and worth it to not have to hassle with ipfw rules 🙂

Each Thursday, Security Musings features a security-related technology or tool. Featured items do not imply a recommendation by Gemini Security Solutions. For more information about how Gemini Security Solutions can help you solve your security issues, contact us!