"Stealth Mode" Firewall not working at all

pinging 'localhost' is not going out to the network & coming back in. It is routing within the system internally. That means the firewall is not seeing those packets. I believe localhost uses the loopback system which does not leave the device.

If you want to test a firewall you need to ping from outside the device. Use the devices IP instead of 'localhost' and run it from another machine.

Stealth mode does very little besides make the Mac more difficult to use, if you enable any sharing features the Mac will open ports for those anyway. Why do you need stealth mode? Most NAT routers will provide protection from threats (e.g. the internet).

P.S. You need to avoid trying to 'rebuild firewall rules to original mode' unless you understand the system. It is very easy to break features, especially if you assume correct behaviour is incorrect…

Hello Gl7-9M,

The Application Firewall is not what people think it is. I suggest turning it off because it doesn't provide any value. It is a bit of a long and complex story. I'll be glad to get up on my soapbox and give it to you if you want, but only if you ask. The bottom line is that a firewall is only useful for network administrators running large networks. The Application Firewall that comes with your Mac is a much less powerful tool and essentially does the exact opposite of what you think it does. Most people are behind some kind of wireless internet router anyway, so your Firewall is only blocking other machines on the network. And if you are actually providing services, by default it will allow external connections.

Hello again Gl7-9M,

Your router has no "defence abilities". If you are concerned enough about security to want to install a firewall, then just don't publish any services on the internet. It's that simple. And if you have a router, regardless of its defensive abilities, you aren't doing that. Unless you have defined some special DMZ zone or port translations inside your router, then it will not redirect anything from the internet to your Mac. That isn't a function of any defensive capabilities, that is just how it works.

Here is the problem with the Application Firewall. If you are publishing any services on the internet, then the default setting for your firewall is also to publish those services. If you configure the firewall to block those services, then they won't work. So why publish them if you are then going to block them? And I can guarantee that "stealth mode" is useless if you are publishing any services. Those services are the first thing any hacker would look for - and you are publishing them.

But wait, I've gotten ahead of myself. You have an internet router. So you aren't publishing anything. Ergo, you have no need for any application firewalls.

the main reason for my concern, is due to the fact I do not trust too much in my router's defence abilities

If you have a home router, then it is impossible for the internet to directly see your Mac, not to mention impossible to ping your Mac from the internet.

This is just a basic feature of a typical home NAT router. That is to say no device behind the home router (any home router) has a directly visible address. This is an inherent feature of all consumer home routers, whether cheap or expensive. Generally the extra cost is for ease of use, or better WiFi, or extra features, or faster network support/WiFi. It has nothing to do with the basic nature the NAT service, which is what makes your Mac not directly addressable from the internet.

The only way the outside world can connect to a device behind your router, is if the device asks the router to make a port available via things like universal-plug-and-play (UPNP).

It is a waste of time turning on the Mac firewall as long as your Mac is behind a home router.

If at home you want stealth mode, you have to have your router do that, as it is the ONLY device visible to the internet.

If you take your Mac out to a public WiFi host spot, then your firewall might be useful (not much, but it might).

But your best defense is to never enable the 'root' account, and to make sure that any accounts you have on your Mac have good passwords.