Application firewall and ipfw

Question

Level 1

75 points

Application firewall and ipfw

Can someone explain the relationship between the Firewall Application and the ipfw command?

Do they operate in parallel or does one take precedence over the other?

If I turn off the application firewall, can I use ipfw to configure the firewall?

For example: I wish to use MySQL which requires port 3306. How would I configure the firewall application to allow connections on port 3306? I have port 3306 block on my router, but this port needs to be open for MySQL to work locally. MySQL is started with a - rather complex - shell script. Dragging the script name to the firewall application does not work

A similar situation exists for service such as: the Apache web server (port 80) and the Tomcat web server (port 8080).

Thanks in advance,

Sy B

PowerMac G5 Quad, Mac OS X (10.5.3), 4 GB memory

Posted on Jul 1, 2008 10:56 AM

Reply

Answer 1

roam

Level 6

13,637 points

Jul 5, 2008 3:26 AM in response to Sy B

As I understand it the Application firewall is aware of ipfw, though in the initial setup ipfw is effectively open, ie the Allow any in ... state is set.

Do they operate in parallel or does one take precedence over the other?

The ipfw can have rules in it that will be accepted by the Application firewall. This is confirmed in this document.

Mac OS X 10.5 Leopard: About the Application Firewall

If I turn off the application firewall, can I use ipfw to configure the firewall?

From my reading of it, I think this is entirely possible.

I don't know how the Application firewall can be configured for any service other that the installed Apple services. You say you "..wish to use MySQL which requires port 3306." Have you tried and it gets blocked?

Reply

Answer 2

Tim Haigh

Level 7

24,198 points

Jul 5, 2008 3:35 AM in response to Sy B

I use IPFW and the built in application firewall on my macbook pro. I use a great utility called water roof which is graphical front end for ipfw.

It is useful to have both firewalls running. for example I want file sharing allowed in my application firewall. But when I goto public networks I don't want that service open. I often forget to turn off files sharing so I have configured ipfw to only allow afp connections from specific IP addresses. Sure and experience hacker could spoof an IP address but this setup stops the casual user in starbucks dropping files in my public folder.

Reply