Firewall - Configuration/GUI of the Mac OS X 10.6 / 10.7 Firewall

Question

simweb Author

Level 1

17 points

Firewall - Configuration/GUI of the Mac OS X 10.6 / 10.7 Firewall

First I would like to thank Apple

for making the Mac OS X operating system.
And thank you for the Lion update coming soon.

We properbly all are waiting to get the

Mac OS X 10.7 Lion update.

I have seen the full feature list of Lion:

http://www.apple.com/macosx/whats-new/features.html

All the great new innovation and apps is great stuff.

But I came to wonder about one thing though.

The internet apps like:

FaceTime, iCloud, iChat, AirDrop etc.

They more or less all requires custom ports on different

protocols to be opened and configurated.

Even the SIP for Facetime has to be enabled etc.

Like the FaceTime Firewall ports here:

http://support.apple.com/kb/HT4245

In the full feature list page of Mac OS X Lion

there is not listed anything about the Mac OS X Lion Firewall!

In Snow Leopard we can't configurate the Firewall with

custom ports and protocols etc.

Everybody refer to the Hanynet NoobProof and WaterRoof

firewall apps. I'm using the NoobProof my self right now.
http://www.hanynet.com

But I think the Mac OS X Snow Leopard and Lion could do with a

much better and way more easier firewall GUI to be able to

configurate ports and protocols and firewall rules and even NAT.

Isn't the Mac OS X about doing it the easy way!

I think a Firewall in Mac OS X with only a On and Off button (more or less)
wont cut it any longer!
For people not knowing about Firewall its OK to have an On/Off button,
but for the user that know about firewall, ports and protocols
it would be great to have a button to go in an be able to configurate
making rules and opening ports on specific protocols and doing NAT etc.

The Mac OS X Firewall GUI created by Bryan Hill called

"Brickhouse" and now called "Flying Buttress"

updated last in 2005!

(Which I could NOT get to work in Snow Leopard)

it had a very good and easy

to use Graphical User Interface. (GUI).

See it here:

http://www.securemac.com/firewallsecurityshareware.php

Why isn't there any like that for the present Mac OS X????

Anybody know anything that will help in that direction???
Anybody know a nicer firewall GUI or App for
Snow Leopard / Lion ???

Please comment here.

Best regards

Jesper

from Denmark.

Mac Pro Mid2010. 2x Xeon 2.4, Mac OS X (10.6.8), Nvidia Quadro 4000. 8 GB ram. OCZ 2,5" SSD's.

Posted on Jul 4, 2011 5:12 AM

Reply

Answer 1

thomas_r.

Level 7

31,989 points

Jul 4, 2011 5:24 AM in response to simweb

Nobody can say anything about Lion yet, other than what Apple has published. You'll need to wait with your concerns about Lion until it has actually been released.

As for alternate firewalls, sounds like you're already aware of the third-party front-ends for the ipfw firewall. So I'm not sure exactly what you're looking for. If you're worried that new network technologies in Lion will have a hard time getting through the built-in application firewall, I'm sure Apple has thought of that and has solutions.

BTW, why are you using a firewall, anyway? There's a good chance you don't actually need it, and are worrying about a non-issue. See Do I need a firewall?*.

* Disclaimer: links to my pages may give me compensation, and should not be taken as endorsement of my services by Apple.

Reply

Answer 2

roam

Level 6

13,637 points

Jul 4, 2011 6:11 AM in response to simweb

Waterroof is a GUI frontend for the native firewall, in the same way Brickhouse was for earlier versions of Mac OS X.

Waterroof is for 10.5 and 10.6

http://www.hanynet.com/waterroof/

Reply

Answer 3

simweb Author

Level 1

17 points

Jul 4, 2011 1:38 PM in response to simweb

Thank you very much for responding to my thread Thomas and roam.

Wheter it is a question to run a firewall on Mac OS X or not,

is not my question. And thank you, but I do know the difference between a

GUI for the Mac OS X built in firewall and a 3rd party stand alone firewall.

If I and properbly many other Mac OS X users choose to run with a firewall,

many of us would like to be able to configurate as WE want it to be.

Many users have special needs that require speciel configuration of the firewall.
There are other things than Apple network technologies you know!

Running a firewall or not. There is Pro's and Con's on both. It's a free choise right. I respect both.
I have 8 CPU cores and 16 threads on my Mac Pro, so I think my Mac can handle a running firewall!
"Better safe, than sorry!" As they say "Over there".
;o)

Apple has chosen to make a firewall in

Mac OS X, then there must be a reason why it is there.

And besides that.

I would bet that, the more popular the

Mac computers gets in the future and the more marketshare

the Mac computers get over the hopeless Windows platform.

The more hackers will be interesting in hacking the Mac OS X.

So a firewall would be something to consider the more Apple has success.

I think that is quite logical.

I'm sure there is almost as many undiscovered security holes in UNIX

as there is on the Windows platform. It is just a question of time

before the hackers will point their weapons against the Mac OS X.

So let me explain a bit more precise what I need…

I'm used to configurate lots of hardware Routers with Firewalls. Doing things like creating firewall rules, opening ports on specific protocols, WAN-to-LAN and LAN-to-WAN, NAT IP redirection, enabling SIP, content filtering, wireless accesspoints with encryption and MAC Address filtering, creating VPN tunnels, setting up Remote Desktop on Windows and Mac computers for Terminal Servers etc.

I'm also administrating FTP servers and NAS harddisks.

All that is always being configurated in a nice intuitive user interface via my web browser. Wheter it is a Router, NAS disk etc. THATS WHAT I WANT with the Firewall in Mac OS X. An "intuitive graphical user inteface" where I easily can configurate the Mac OS X firewall or a stand-alone firewall for that matter.

Yes I self use on my Mac Pro the Hanynet NoobProof firewall GUI right now.

But both the Hanynet firewall GUI's are crap. Lets face it!

They work yes! But the User Interface is NOT Mac OS X standard right!!!

If you pair the user interfaces with standard unser interfaces of a normal end-user Gateway Router with Firewall. Like ZyXEL, NetGear etc.

The Hanynet NoobProof don't have the feature to

choose ports on specific protocols.

With Apple FaceTime there are ports on both the

TCP and UDP protocols that has to be open for communication.

On the other side the Hanynet WaterRoof GUI

I know that it has the features to configurate ports on specific protocols but!

The User Interface is waaaaaaaay too complex and is anything else than intuitive!

I can't find ether head or tale in WaterRoof GUI!!! Completely Lawsy Interface. It is SO non Mac like!

(it needs a interface designer like myself)

I mean, "The Mac" and Mac OS X is all about doing things the "EASY, Nice and Intuitive Way" right!

I can't be that I'm the only one in the world that need a better and faster configuration of the Mac OS X firewall, can it?! There must be hundred thousands of other Mac OS X users with the same wish.

I know I'm a "designer", not a "programmer".

The only thing I program is HTML, CSS and DVD Video titles.

So with all due respect.

*** The question is…

Does anybody know a Firewall GUI or stand alone firewall for Mac OS X Snow Leopard/Lion that are easier than Hanynets????????????????

=========

If I was an Apple employed that delt with Mac OS X security.

I would make the Mac OS X firewall user interface different.

Top level choise could be: ON, OFF and CUSTOM.

So people with non knowledge of firewalls could just choose ON or OFF

to their liking. And leaving the choise for people that would like

to customize the firewall settings with the "Custom" button.

And there after a nice intuitive graphical user interface

to make all sorts of custom settings JUST like on a Gateway Router with built in firewall.

A firewall like that could not hurt anybody could it???!!!

It's MY Mac, I want to rule over MY firewall.

I like the Mac OS X very much, I think it is absolutely brilliant,

but the Firewall settings is NO GOOD for custom firewall configurations.

Apple has to pay attention to it, the sooner the better.

Please feel free to comment.

Best regards

Jesper

Denmark.

Reply

Answer 4

Barney-15E

Level 10

112,848 points

Jul 4, 2011 1:53 PM in response to simweb

Your verbose text seems to imply you think you are talking to Apple employees, here. In case that is a correct assumption, we are not Apple employees. For the most part, the only thing Apple monitors here is violations of the terms of use. We can't change how Apple operates, nor can we communicate with Apple Engineers.

If you think you have some useful feedback for Apple, please use the feedback channels for communicating with Apple as your "problem" is not solvable by us. The two most useful responses, (1. you don't need a firewall, and 2. use WaterRoof) you shot down.

Apple already had a GUI for configuring ipfw and disposed of it for a simpler Application-based firewall. The vast majority of users have zero need for a firewall, so it was simplified. However, they did leave ipfw fully functional for those that need more control.

As to your statement that Apple has a firewall, it must be necessary is really not a valid assumption. Thomas' link has an entire section dealing with that falacy. When I flew in the Air Force, the jets I flew had an ejection seat. Since they installed it, they must have wanted me to use it, right? Well, in 20 years, I never did. It was installed in case I needed it in specific situations, not to be used daily. I knew a few people who found themselves in need of the seat, but the vast majority never needed it.

I'm sure there are people who need a firewall, but for the most part, very few need it. Apple kept it in there in case someone had a need for it, but not necessarily for everyone to use it all the time. If they thought you needed it on all the time, they would have configured it to be on all the time without you being able to turn it off.

Reply

Answer 5

simweb Author

Level 1

17 points

Jul 5, 2011 2:23 PM in response to simweb

When all you Point-Chasers are finished spamming my thread.

I might be able to get an ANSWER to my question from the real mac people!!!!!!!!!!

I dont need lectures, I need a simple answer to MY SIMPLE QUESTION!!!
Don't waste my time any more.

Here in scandinavia time is money!

Thank you!

Reply

Answer 6

Star1

Level 2

465 points

Jul 5, 2011 2:46 PM in response to simweb

Hi simweb,

I'd recommend to learn how to be polite in your next post...

Reply

Answer 7

simweb Author

Level 1

17 points

Jul 5, 2011 2:58 PM in response to simweb

As I wrote in my present post.
I DONT NEED LECTURES!
I recommend that people that dont have a precise answer to the questions KEEP AWAY!!!

Thank you.

Reply

Answer 8

ds store

Level 7

30,745 points

Jul 5, 2011 2:59 PM in response to simweb

simweb wrote:

I might be able to get an ANSWER to my question from the real mac people!

I dont need lectures, I need a simple answer to MY SIMPLE QUESTION!

Thank you!

Simply put, Apple caters to the 90% of the consumer market that couldn't tell you the difference between a ipfw and a SCSI terminator.

So the more advanced users use software more configured to their needs.

Apple isn't going to do away with the Firewall it's too vital, and if they do, there will be a third party solution out in a week or two.

What Apple does is likely make it less accessible from the 90% of people who will only mess up their machines using it and have to handle the support calls resulting from it.

No need to worry or get mad. 😀

Reply

Answer 9

simweb Author

Level 1

17 points

Jul 5, 2011 3:26 PM in response to ds store

Thank you ds store... (cool login name you have)

Well I think you are right. Even when I have a Mac "PRO" that I paided a million bucks fore, I still can't
get to my firewall config. It's very sad.

Well it's not all true.
Hanynet GUI's does the job, so I don't understand why there isen't any other firewall GUI's out there for Snow Leopard. Hundred of users are willing to pay for them. I'm sure.

Funny what you said,...
"The Firewall that could be configurated and 90% of the Mac users would mess up their Mac...
ha ha ha ha ha ha!
You mean that it is not the geeks that have a Mac then! Well I'm a geek and I want to be in control.

About development for the Mac OS X Firewall GUI
I have an idea. There could be a "RESET Firewall to default" button!!!
and it could be a big red button that flashes!!
You know for the Dummies.

ha ha ha ha!
;o)
Sorry for my sarcasm. (Scandinavian humour).
;o)

I will use the opotunity again to call out to the Mac Geeks

Don't anybody know of 3rd party Mac OS X Snow Leopard Firewall GUI's or 3rd party stand alone firewalls for the Mac OS X Snow Leopard?????? Other than the Hanynet's

I'm having a hard time getting the Mac people up of the chairs I guess!
Or It could be you are right ds store. 90 % og the Mac People is... well you know!!!
ha ha ha ha ha!
Let that be an open invitation to the Mac geeks!

Thank for you positive post ds store.

LETS GEEK OUT!

Best regards
Jesper
Denmark

Reply

Answer 10

Barney-15E

Level 10

112,848 points

Jul 5, 2011 4:46 PM in response to simweb

simweb wrote:

When all you Point-Chasers are finished spamming my thread.

I might be able to get an ANSWER to my question from the real mac people!!!!!!!!!!

I dont need lectures, I need a simple answer to MY SIMPLE QUESTION!!!
Don't waste my time any more.

Here in scandinavia time is money!

Thank you!

Well, you seem to be wasting a lot of it (both time and money) trying to find a way to configure something you don't need.

If you think someone will pay for it, put up the cash, hire a programmer, and then try to sell it.

It's pretty ironic that you want to Geek out, but you want to use a GUI. Really geek out and learn to use the command line ipfw.

Reply

Answer 11

thomas_r.

Level 7

31,989 points

Jul 5, 2011 6:59 PM in response to simweb

I dont need lectures, I need a simple answer to MY SIMPLE QUESTION!!!

I haven't spotted a simple question yet. I've spotted pages and pages of dull, confusing, flow-of-consciousness prose that doesn't seem to say much beyond "I want a better firewall and Apple is bad for not giving it to me." That's not a question, it's a rant, and against the terms of use of these forums. And by being so rude about it, you've alienated most of the knowledgable people here.

Reply

Answer 12

Jul 28, 2011 7:13 AM in response to simweb

"I can't be that I'm the only one in the world that need a better and faster configuration of the Mac OS X firewall, can it?! There must be hundred thousands of other Mac OS X users with the same wish."

well... basically that's the reason why I developed WaterRoof. And please note: I am NOT a developer.

"I know I'm a "designer", not a "programmer".

The only thing I program is HTML, CSS and DVD Video titles."

yes... and you need to configure the Mac OS X ipfw network firewall in order to "feel safe", right?

"Hanynet GUI's does the job, so I don't understand why there isen't any other firewall GUI's out there for Snow Leopard. Hundred of users are willing to pay for them. I'm sure"

If you know what a firewall is, if you are aware of how networks work, if you really need a firewall... no, you are not willing to pay for something you already own. Jesper my opinion is that you don't need a firewall. Your Mac has two firewalls, use the one in system preferences, just click start. Nothing is easier than that.

Reply

Answer 13

simweb Author

Level 1

17 points

Jul 28, 2011 8:02 AM in response to hany el imam

Hello Hanynet Developer.

Well no hard feelings about your WaterRoof and NoobProof GUIs
for the Mac OS X Firewall.

I think you are great, making the firewall GUI.
Nobody else seems to have done anything like your GUIs
Let me say that very clearly.

Yesterday I uninstalled NoobProof and tried your WaterRoof 3.4
I had dificulty to type in a IP range in a static firewall rule.
I did a mail on that to hanynet, you proberbly have read it already.
Until I know how to type in a IP range in WaterRoof I dont use it.
But then I will use it again. Until I have new solution I use the
built in firewall in Lion. Which I dont like. (no control).

I see today you have made a 3.4.1 version of WaterRoof.
Have you addressed the IP range in that version Hanynet?

================================

And now to address all the Point Chasers in here:

I know the built in Mac OS X Lion firewall.
It off cause can handle all the Apple technologies,
but is not good at handling other 3rd party technologies.
Perhaps I want a specific protocol on a specific port to a
range of IP addresses to be open and to tell that only a surtain App can respond to that firewall opening!

Perhaps I need that! Could be a lot of Pro users needed that and to have that they don't use a fireall at all!!!
A firewall rules like that, I can't do in the Built in firewall in Lion.
I know how to configurate a Firewall in a Gateway Router.
So I'm used to configurate firewalls. Being 100% in control!
I like to be in control.

What I need or not need is not the question in this thread is it!
I posted a QUESTION here, and I STILL NOT have any SOLUTION to MY question.
Just a lot of forum point chasers telling their stories about Mac Life in general.
Well, thats a fact still to this day.

Those forum supporters are allright for the general Mac home users.
I respect the serious of them.

But I can't use their information for my question.
I'm a serious geek, I need geek answers/solutions.

If I choose to have a 3rd Party firewall running,
let me for gods sake have that pleasure!
I only have one life on this doubtful planet.
It's a free country where I live.

In stead of getting angry and telling me what I should do,
I need a solution to my question STILL!

/Peace, I love you all.

Reply

Answer 14

Jul 28, 2011 10:07 AM in response to simweb

To specify a range with ipfw you must use subnets like 192.168.10.1/24, 192.168.0.1/16 and so on. Using a subnet calculator will help you. There's no other way, and this is about ipfw and not WaterRoof. You can however type a list of IP addresses, separated by commas like 12.13.14.15,33.44.55.66,111.112.113.114 .

Please note that WaterRoof is a "frontend for the Apple-shipped built-in Mac OS X ipfw network firewall", and not a "3rd party firewall." Exactly like NoobProof, DoorStopX, Brickhouse, and others.

Reply

Answer 15

simweb Author

Level 1

17 points

Jul 28, 2011 2:53 PM in response to hany el imam

Hi Hanynet

Thanks for answering,
you are the only one that speaks my language in here!!!

First Yes yes yes I know the difference between a two-way software 3rd party firewall application like the Symantec Endpoint Protection and Norton Internet Security on the Windows platform etc.. And then a GUI front-end for the original Apple supplied built-in firewall "engine". What your WaterRoof and NoobProof is doing is scripting language to the built-in firewall. And that is way cool work Hanynet! Keep up the good work there!

About the IP range in static firewall rules in WaterRoof.

I tried that in your waterRoof 3.4 version just yesterday or the day before that. I even send you an e-mail to the hanynet.com website e-mail address about the problem.

When I made a new empty static firewall rules and typed in a IP range like:

192.168.1.9,192.168.1.10,192.168.1.11,192.168.1.12,192.168.1.13,192.168.1.14,192 .168.1.15…

all the way up to 192.168.1.69 where I wanted port 515 and 631 on TCP protocol opened for the IP range.

Then WaterRoof showed this in the firewall rule:

"allow tcp from 67.215.77.132 515,631 to me dst-port 515,631"

It can't be correct. It gave me no logic.

The "67.215.77.132" I did not understand!
The 515,631 is the ports I want opened, thats good.
But not the IP address (range).

Perhaps there is a charactor number limitation on the IP addres field or something else is wrong.

I also tried the Range like this: 192.168.1.9-192.168.1.69

It would not eat that ether.
All ZyXEL, Netgear etc.. Gateway Routers firewall understands that kind of IP range typed in like that. So it could be that the Apple firewall could understand it as well. Its much easier than typing in all 60 IP addresses after each other in every static firewall rule

Making a firewall rules like this example:

========================================

Static firewall Rule:

- Rule name: Printer Sharing

- Rule type: Allow

- Address: Range:192.168.1.9-192.168.1.69

- Protocol: TCP only

- Port: 513,631

- Direction: Both

- Applications: "C:\program files\windows live\remotedesktop.exe"

- Schedule: All the time

=======================================

On Windows platform in software firewalls like

the Symantec Endpoint Protection that can be done easily.

The built in firewall in Mac OS X Lion has the option to

allow/deny different apps to communicate with connections outside.

So I guess this option is built-in.

How far the configutation can be per application level that I don't know.
Thats up to Hanynet.com to find out.

What do you think Hanynet?

I will look at the Subnet Calculators you write about...

thanks again.

Reply