Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I don't want this to be subjective, so I'll try to make the requirements as clear as possible.

On a Mac with Snow Leopard, how can I set up the firewall rulesets that allow ONLY:

Using the internet through standard browsers (Safari, Chrome, Firefox), software updates, Skype, iTunes, and ftp access to upload data to a web site.

No need for Mobile Me, iCal, address book, iChat, etc.

If the ftp access presents a big hole in the firewall, then I'd rather use a separate PC to do the uploading, but I think I can simply open the port for that, correct?

So basically, everything else is blocked.

An example of rulesets I'm looking for is: ipv4, deny ip from 127.0.0.0/8 to any in, for both ivp4 and ivp6.

I've read through much of the documentation for the firewall, and searched through information on several sites, but it's all very cryptic to a security noob.

share|improve this question
    
Turns out I can't up-vote...need 15 rep. –  Javy Jan 28 '11 at 10:16
    
What are you protecting, exactly? You're worried your OS X install is attacked? –  Alex Holst Jan 28 '11 at 12:19
    
Actually, yes. I've had several hack attempts in the past, some of which were successful. At one point they even broke into my residence and changed the firmware on one of my computers. So now I have to take extraordinary measures to defend against them. Call it paranoid if you want, but this is the problem I face daily. So assistance in setting up a very strong firewall is greatly appreciated. –  Javy Jan 28 '11 at 12:31
7  
You have bigger issues if people are breaking into your house to get what they want. A firewall won't solve all of your problems. But nevertheless, good question. –  Steve Jan 28 '11 at 18:15

5 Answers 5

up vote 6 down vote accepted

According to this table, the software update goes through the same port than the HTTP protocol, so you really just need to open up port 80. Additionally to port 80, I would suggest the following:

  • 443 -> HTTPS
  • 22 -> SSH
  • 115 -> SFTP (don't use regular FTP if you can help it. If you are that paranoid, stick to SFTP. Otherwise, use 20*)
  • 587 -> Authenticated SMTP (Enable 25 if not applicable*)
  • 993 -> SSL IMAP (Enable 143 if not applicable*)
  • 995 -> SSL POP (Enable 110 if not applicable*)

*These are the ports for the unsecured versions of that same protocol

If you don't use Mail either, you can remove 25, 143, 110, 587, 993 and 995 from the list. If you don't use SSH, you can also remove 22.

Regarding iTunes:

iTunes itself uses port 80, so it is already set. the iTunes store uses SSL (i.e. 443) which is already open Airplay also goes through 80. The following ports also need to be open if you use any of those features

  • 3689 -> iTunes Music Sharing
  • 8000-8999; 42000-42999 -> iTunes Radio Streams

Regarding Skype:

Acording to a forum at Skype, Skype uses ports 80 or 443, depending on your settings.

What you probably won't like is that a lot of services (including mobileme and ical services also use port 80, so you won't be able to block everything with only port blocking).

share|improve this answer
    
Ah, this is what I'm looking for! How would I specify blocking all but these ports for both ipv4 and ipv6? –  Javy Jan 28 '11 at 11:09
    
I played around with ipfw but can't seem to make it work. Maybe someone else here knows how to create the script but, so far, i failed at that. –  Mike Jan 28 '11 at 12:39
    
I can set up the rules, I just need to know what they are. –  Javy Jan 28 '11 at 12:40
    
I guess you are already blocking any incoming connections (every Firewall should do that by default), so you only have to block all the outgoing connections too and add exceptions to the ports you want to use. For that I'd say you set up a rule with a high rule_number that blocks all outgoing connections, then add rules with lower rule_number that allow the specific ports. Also, disable sharing in the preferences since I believe they are handled by ipfw anytime. –  Mike Jan 28 '11 at 12:47

Go buy Little Snitch http://www.obdev.at/products/littlesnitch/index.html for $30.

Little Snitch informs you whenever a program attempts to establish an outgoing Internet connection. You can then choose to allow or deny this connection, or define a rule how to handle similar, future connection attempts. This reliably prevents private data from being sent out without your knowledge. Little Snitch runs inconspicuously in the background and it can also detect network related activity of viruses, trojans and other malware

And in your System Preferences | Security | Firewall, ensure your Firewall is on, select Advanced and checkmark "Block all incoming connections".

For ultra-paranoid surfing, buy VMware Fusion (http://www.vmware.com/products/fusion/), install your OS of choice in a virtual machine and use that for surfing. After a round of browsing in the dark, you can hit revert to restore your virtual machine to its virgin state. You could also build several virtual machines and use the appropriate one for the tasks at hand (e.g. virtual system A for when you do banking activities, virtual system X for when you do dastardly activities).

share|improve this answer
    
I use LS already, however, it's an application firewall. I'm looking for Mac OS firewall control. The default settings for the GUI controls on Mac firewall is not secure enough IMO. LS is a great program, though. –  Javy Jan 28 '11 at 9:28
    
If you want to check out what is allowed after selecting "block all incoming connections", see this apple doc: support.apple.com/kb/ht1810 –  Tate Hansen Jan 28 '11 at 9:42
3  
+1 for the VMware suggestion –  Mike Jan 28 '11 at 10:54
2  
-1 for trying to solve security problems by introducing more code and more complexity (VMs). –  Alex Holst Jan 28 '11 at 18:22
2  
@Alex using VMs for this purpose is good thing and well known. Joanna Rutkowska speaks well of the technique and she's pretty hip on using/exploiting VMs. "I use different virtual machines to host various types of browsers that I use for different kind of activities. So, I use a "Red" VM to do daily browsing, something totally non-sensitive like news reading, Googling, etc. I use a "Yellow" machine to do some semi-sensitive tasks, like online shopping, updating my blog on Blogger, etc. Finally, I have a "Green" machine to access my bank's account." –  Tate Hansen Jan 28 '11 at 19:01

Consider the following additions to your ipfw ruleset:

  1. ipfw add deny ip from any to any not verrevpath in - verify the interface on which the packet entered the system matches the outgoing interface for the route (best placed at top of the ruleset)
  2. Logging - just as important as the rules themselves to understand what is being blocked and why it's happening. There are applications which can help with analysis, there's other topics on this board with recommendations.
  3. ipfw add check-state - in addition to restricting ports/protocol, have ipfw only allow connections which match an internally initiated connection.

Source: IPFW Man Page

share|improve this answer

Assuming you're really trying to protect against someone with the resources to enter your home and install malware on your home routers, a firewall isn't going to do you any good at all.

If "they" can compromise your home routers, they can find bugs in Chrome, Safari, Skype and whatever network tools you use and execute code on your system through those means.

If you really want help - assuming you're some kind of human rights activist under government pressure - start a new question where you describe the actual situation instead of asking for help setting up a firewall.

share|improve this answer
    
These people try not to leave traces of entry. I make it a point to lock away my router and other peripherals in a way that if it gets physically accessed, I will know it. Every time I leave my residence it gets put away. I always carry my laptop with me to prevent physical access as well. My goal is merely to to setup my firewall as strong as possible. I'm well aware of VM's, app firewalls like Little Snitch, and even use a VPN with strong encryption. If I'm able to setup my firewall with the strongest restrictions possible based on my software needs, then my goal will be achieved. –  Javy Jan 28 '11 at 19:34

i wish i knew more about computers… i try to hang, but i understand if they want to break in and break the law they will… i just want to know why isn't everyone being targeted? it seems like only a few of us are targets. most kids using TOR or downloading from the internet don't seem to be targets.

anyway, i've been noticing strange stuff on all the computers for a while, i just figured if someone's personal information like money in the bank, SS, license number, etc. gets used or stolen or connected with any crimes, i'll just blame it all on hackers and intruders.

countless times i've noticed weird firmware issues, weird macros executing, weird java script files, weird downloads, weird access and entries, weird keychain permissions, etc.

how can they ever tell us or teach us right from wrong if they themselves are the ones doing much worse.

share|improve this answer
    
Welcome to the site. Please consider answering the question rather than expressing personal opinions about it. –  Ebenezar Mar 21 at 7:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.