Mac OS X Firewall

Introduction

Mac OS X comes with a built-in two-way firewall called IPFW. After version 10.2, a user-friendly graphical interface is also available to assist with basic firewall configurations.

Pros and cons

Like any firewall, IPFW holds both benefits and cautions for its users.

Pros:

• Users of OS X 10.2 and later also have the option of using a single-click, easy-on/easy-off interface.
• Additional command line interface is powerful and customizable.

Cons:

• For pre-10.2 systems, the command line interface may be unfamiliar to long-time Macintosh GUI users.
• The one-click firewall option is more limited in its configuration options than the command line. It will automatically configure itself for what it believes an application needs; if it's correct, your network will communicate properly. But if the autoconfiguration is not correct, your possibilities for manually correcting it are limited to the command line.

Activation

The graphical user interface is available in the System Preferences application. In the Network area, select Sharing. The Sharing window contains three tabs, including the Firewall tab.

Enabling or disabling the firewall can be performed with the click of a button; you can also use the graphical interface to selectively enable or disable the firewall for certain services such as FTP connections.

For users familiar with the Unix command line, the ipfw command line interface is more powerful and can be used to create more elaborate rule sets.

Additional information on using both the graphical interface and the command line to control IPFW can be found at:

http://www.macdevcenter.com/pub/a/mac/2002/12/27/macosx_firewall.html

Additional information for VPN users

In order to permit your system to communicate with the UIUC VPN through the IPFW firewall, you may need to create custom rules through either the graphical interface or the command line interface. A list of the ports which need to be permitted to communicate with the VPN server are listed in the Wireless and VPN FAQ.

However, even with the VPN, your computer will not be able to run its own web server, FTP server, or other service replying to requests from outside. The UIUC VPN server does not allow you to create permanent connections with a fixed IP address; your VPN connection will eventually time out even if you leave your computer connected and running.

More information

For additional assistance with the Mac OS X IPFW firewall:

• Check Apple's online help system.
• Run man ipfw in the command line interface.
• Various online guides (like the MacDevCenter guide) can also provide guidelines for custom-configuring your firewall to suit your needs.