What firewall settings on a Macintosh are the most restrictive, while still permitting casual internet use?

Question

I don't want this to be subjective, so I'll try to make the requirements as clear as possible.

On a Mac with Snow Leopard, how can I set up the firewall rulesets that allow ONLY:

Using the internet through standard browsers (Safari, Chrome, Firefox), software updates, Skype, iTunes, and ftp access to upload data to a web site.

No need for Mobile Me, iCal, address book, iChat, etc.

If the ftp access presents a big hole in the firewall, then I'd rather use a separate PC to do the uploading, but I think I can simply open the port for that, correct?

So basically, everything else is blocked.

An example of rulesets I'm looking for is: ipv4, deny ip from 127.0.0.0/8 to any in, for both ivp4 and ivp6.

I've read through much of the documentation for the firewall, and searched through information on several sites, but it's all very cryptic to a security noob.

Answer 1

According to this table, the software update goes through the same port than the HTTP protocol, so you really just need to open up port 80. Additionally to port 80, I would suggest the following:

• 443 -> HTTPS
• 22 -> SSH
• 115 -> SFTP (don't use regular FTP if you can help it. If you are that paranoid, stick to SFTP. Otherwise, use 20*)
• 587 -> Authenticated SMTP (Enable 25 if not applicable*)
• 993 -> SSL IMAP (Enable 143 if not applicable*)
• 995 -> SSL POP (Enable 110 if not applicable*)

*These are the ports for the unsecured versions of that same protocol

If you don't use Mail either, you can remove 25, 143, 110, 587, 993 and 995 from the list. If you don't use SSH, you can also remove 22.

Regarding iTunes:

iTunes itself uses port 80, so it is already set. the iTunes store uses SSL (i.e. 443) which is already open Airplay also goes through 80. The following ports also need to be open if you use any of those features

• 3689 -> iTunes Music Sharing
• 8000-8999; 42000-42999 -> iTunes Radio Streams

Regarding Skype:

Acording to a forum at Skype, Skype uses ports 80 or 443, depending on your settings.

What you probably won't like is that a lot of services (including mobileme and ical services also use port 80, so you won't be able to block everything with only port blocking).

Answer 2

Go buy Little Snitch http://www.obdev.at/products/littlesnitch/index.html for $30.

Little Snitch informs you whenever a program attempts to establish an outgoing Internet connection. You can then choose to allow or deny this connection, or define a rule how to handle similar, future connection attempts. This reliably prevents private data from being sent out without your knowledge. Little Snitch runs inconspicuously in the background and it can also detect network related activity of viruses, trojans and other malware

And in your System Preferences | Security | Firewall, ensure your Firewall is on, select Advanced and checkmark "Block all incoming connections".

For ultra-paranoid surfing, buy VMware Fusion (http://www.vmware.com/products/fusion/), install your OS of choice in a virtual machine and use that for surfing. After a round of browsing in the dark, you can hit revert to restore your virtual machine to its virgin state. You could also build several virtual machines and use the appropriate one for the tasks at hand (e.g. virtual system A for when you do banking activities, virtual system X for when you do dastardly activities).

Answer 3

Consider the following additions to your ipfw ruleset:

1. ipfw add deny ip from any to any not verrevpath in - verify the interface on which the packet entered the system matches the outgoing interface for the route (best placed at top of the ruleset)
2. Logging - just as important as the rules themselves to understand what is being blocked and why it's happening. There are applications which can help with analysis, there's other topics on this board with recommendations.
3. ipfw add check-state - in addition to restricting ports/protocol, have ipfw only allow connections which match an internally initiated connection.

Source: IPFW Man Page

Answer 4

Assuming you're really trying to protect against someone with the resources to enter your home and install malware on your home routers, a firewall isn't going to do you any good at all.

If "they" can compromise your home routers, they can find bugs in Chrome, Safari, Skype and whatever network tools you use and execute code on your system through those means.

If you really want help - assuming you're some kind of human rights activist under government pressure - start a new question where you describe the actual situation instead of asking for help setting up a firewall.