I don't want this to be subjective, so I'll try to make the requirements as clear as possible.

On a Mac with Snow Leopard, how can I set up the firewall rulesets that allow ONLY:

Using the internet through standard browsers (Safari, Chrome, Firefox), software updates, Skype, iTunes, and ftp access to upload data to a web site.

No need for Mobile Me, iCal, address book, iChat, etc.

If the ftp access presents a big hole in the firewall, then I'd rather use a separate PC to do the uploading, but I think I can simply open the port for that, correct?

So basically, everything else is blocked.

An example of rulesets I'm looking for is: ipv4, deny ip from to any in, for both ivp4 and ivp6.

I've read through much of the documentation for the firewall, and searched through information on several sites, but it's all very cryptic to a security noob.

  • Turns out I can't up-vote...need 15 rep. Jan 28, 2011 at 10:16
  • What are you protecting, exactly? You're worried your OS X install is attacked?
    – Alex Holst
    Jan 28, 2011 at 12:19
  • Actually, yes. I've had several hack attempts in the past, some of which were successful. At one point they even broke into my residence and changed the firmware on one of my computers. So now I have to take extraordinary measures to defend against them. Call it paranoid if you want, but this is the problem I face daily. So assistance in setting up a very strong firewall is greatly appreciated. Jan 28, 2011 at 12:31
  • 7
    You have bigger issues if people are breaking into your house to get what they want. A firewall won't solve all of your problems. But nevertheless, good question.
    – Steve
    Jan 28, 2011 at 18:15

4 Answers 4


According to this table, the software update goes through the same port than the HTTP protocol, so you really just need to open up port 80. Additionally to port 80, I would suggest the following:

  • 443 -> HTTPS
  • 22 -> SSH
  • 115 -> SFTP (don't use regular FTP if you can help it. If you are that paranoid, stick to SFTP. Otherwise, use 20*)
  • 587 -> Authenticated SMTP (Enable 25 if not applicable*)
  • 993 -> SSL IMAP (Enable 143 if not applicable*)
  • 995 -> SSL POP (Enable 110 if not applicable*)

*These are the ports for the unsecured versions of that same protocol

If you don't use Mail either, you can remove 25, 143, 110, 587, 993 and 995 from the list. If you don't use SSH, you can also remove 22.

Regarding iTunes:

iTunes itself uses port 80, so it is already set. the iTunes store uses SSL (i.e. 443) which is already open Airplay also goes through 80. The following ports also need to be open if you use any of those features

  • 3689 -> iTunes Music Sharing
  • 8000-8999; 42000-42999 -> iTunes Radio Streams

Regarding Skype:

Acording to a forum at Skype, Skype uses ports 80 or 443, depending on your settings.

What you probably won't like is that a lot of services (including mobileme and ical services also use port 80, so you won't be able to block everything with only port blocking).

  • Ah, this is what I'm looking for! How would I specify blocking all but these ports for both ipv4 and ipv6? Jan 28, 2011 at 11:09
  • I played around with ipfw but can't seem to make it work. Maybe someone else here knows how to create the script but, so far, i failed at that.
    – Mike
    Jan 28, 2011 at 12:39
  • I can set up the rules, I just need to know what they are. Jan 28, 2011 at 12:40
  • I guess you are already blocking any incoming connections (every Firewall should do that by default), so you only have to block all the outgoing connections too and add exceptions to the ports you want to use. For that I'd say you set up a rule with a high rule_number that blocks all outgoing connections, then add rules with lower rule_number that allow the specific ports. Also, disable sharing in the preferences since I believe they are handled by ipfw anytime.
    – Mike
    Jan 28, 2011 at 12:47

Go buy Little Snitch http://www.obdev.at/products/littlesnitch/index.html for $30.

Little Snitch informs you whenever a program attempts to establish an outgoing Internet connection. You can then choose to allow or deny this connection, or define a rule how to handle similar, future connection attempts. This reliably prevents private data from being sent out without your knowledge. Little Snitch runs inconspicuously in the background and it can also detect network related activity of viruses, trojans and other malware

And in your System Preferences | Security | Firewall, ensure your Firewall is on, select Advanced and checkmark "Block all incoming connections".

For ultra-paranoid surfing, buy VMware Fusion (http://www.vmware.com/products/fusion/), install your OS of choice in a virtual machine and use that for surfing. After a round of browsing in the dark, you can hit revert to restore your virtual machine to its virgin state. You could also build several virtual machines and use the appropriate one for the tasks at hand (e.g. virtual system A for when you do banking activities, virtual system X for when you do dastardly activities).

  • I use LS already, however, it's an application firewall. I'm looking for Mac OS firewall control. The default settings for the GUI controls on Mac firewall is not secure enough IMO. LS is a great program, though. Jan 28, 2011 at 9:28
  • If you want to check out what is allowed after selecting "block all incoming connections", see this apple doc: support.apple.com/kb/ht1810 Jan 28, 2011 at 9:42
  • Another great resource, though it's for Leopard, is the following: images.apple.com/server/macosx/docs/… Jan 28, 2011 at 9:57
  • 2
    -1 for trying to solve security problems by introducing more code and more complexity (VMs).
    – Alex Holst
    Jan 28, 2011 at 18:22
  • 2
    @Alex using VMs for this purpose is good thing and well known. Joanna Rutkowska speaks well of the technique and she's pretty hip on using/exploiting VMs. "I use different virtual machines to host various types of browsers that I use for different kind of activities. So, I use a "Red" VM to do daily browsing, something totally non-sensitive like news reading, Googling, etc. I use a "Yellow" machine to do some semi-sensitive tasks, like online shopping, updating my blog on Blogger, etc. Finally, I have a "Green" machine to access my bank's account." Jan 28, 2011 at 19:01

Consider the following additions to your ipfw ruleset:

  1. ipfw add deny ip from any to any not verrevpath in - verify the interface on which the packet entered the system matches the outgoing interface for the route (best placed at top of the ruleset)
  2. Logging - just as important as the rules themselves to understand what is being blocked and why it's happening. There are applications which can help with analysis, there's other topics on this board with recommendations.
  3. ipfw add check-state - in addition to restricting ports/protocol, have ipfw only allow connections which match an internally initiated connection.

Source: IPFW Man Page


Assuming you're really trying to protect against someone with the resources to enter your home and install malware on your home routers, a firewall isn't going to do you any good at all.

If "they" can compromise your home routers, they can find bugs in Chrome, Safari, Skype and whatever network tools you use and execute code on your system through those means.

If you really want help - assuming you're some kind of human rights activist under government pressure - start a new question where you describe the actual situation instead of asking for help setting up a firewall.

  • These people try not to leave traces of entry. I make it a point to lock away my router and other peripherals in a way that if it gets physically accessed, I will know it. Every time I leave my residence it gets put away. I always carry my laptop with me to prevent physical access as well. My goal is merely to to setup my firewall as strong as possible. I'm well aware of VM's, app firewalls like Little Snitch, and even use a VPN with strong encryption. If I'm able to setup my firewall with the strongest restrictions possible based on my software needs, then my goal will be achieved. Jan 28, 2011 at 19:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .