IMO, ipfw (the firewall already built-in and running on your Mac) is a very good firewall. Unfortunately, the controls that Apple has given you render the firewall nearly useless, so I suggest learning to control it via the command line, or with a 3rd party utility like Sunshield or Brickhouse.
Why? (as people inevitably ask)
rueyeet said:
As a matter of curiosity, what can ipfw do via the command line that you can't do via the Apple-provided GUI? A blanket statement that "it's Bad" isn't much use if you don't say exactly WHY it's Bad.
I want finer grained control in my firewall. It's just not there with the Apple GUI control. But that's a small point of contention.
A larger point of contention is, there is NO WAY to turn on logging in the Apple control! What good is a firewall if you have no idea what is happening with it? Are you just going to press the "on" button and hope that it's doing a good job? How do you know if you're being targeted? How can you know who is touching which port? Logging is a very important part of a firewall and it's just no an option.
And finally, the biggest problem of all..
The Apple GUI control offers NO way to block specific IPs or ranges of IPs. It's all or nothing. This renders the firewall completely useless. It's about as effective as not running a firewall at all. Any service that is running and listening for external connections will show up through a port scan when the Mac is firewalled using the Apple-config, the same as it would if there was no firewall "running" (technically, ipfw is ALWAYS running, it's default rule set is "allow all from any to any", but this is equivalent to it being "off"). You cannot specify, hey, I'll let my buddy Foo from so-and-so connect to my FTP server, but everyone else can keep the hell out.
So, without being able to block IPs, nor have logging to know whom is touching my box (no pun), Apple has rendered ipfw impotent. It's benefits are miniscule.
Using ipfw from the command line (or BrickHouse/SunShield if you need/want GUI) allows for MUCH greater control.
I deny most external ICMP requests, and log when they connect:
Code:
02003 deny log icmp from any to any in icmptype 8,10,13,15,17
I have a blacklist of hosts that are naughty, and log when they try to connect:
Code:
# naughty host blacklist:
00500 unreach host-unknown log ip from 216.42.81.141 to any in
00501 unreach host-unknown log ip from 216.42.81.143 to any in
00502 unreach host-unknown log ip from 211.0.0.0/8 to any in
00503 unreach host-unknown log ip from 80.116.0.0/16 to any in
00504 unreach host-unknown log ip from 207.103.247.50 to any in
00505 unreach host-unknown log ip from 221.0.0.0/8 to any in
00506 unreach host-unknown log ip from 220.0.0.0/8 to any in
00507 unreach host-unknown log ip from 80.117.0.0/16 to any in
00509 unreach host-unknown log ip from 210.0.0.0/8 to any in
Unless I'm on vacation, I only allow ssh connections from a "trusted" source range of IPs, and I log all connections:
Code:
00935 allow log tcp from 152.16.0.0/16 to any 22 in
I only allow DNS from "trusted" sources, limiting my exposure to DNS spoofing:
Code:
00920 allow udp from 209.x.x.x 53 to any in
00921 allow udp from 209.x.x.x 53 to any in
Etc, etc, etc,...
No need to bore you anymore, I think you get the idea.
If you value your security, do yourself a favor and don't just click the "Start Firewall" button, learn to use it properly.
