MacOS Firewall Needed or Unnecessary?

Question

Coming from Windows to macOS, I was surprised that the firewall was off by default. I immediately turned this feature on. Would this be necessary? Are there some cons to having the firewall on that I am not aware of hence why Apple turned it off?

Answer 1

It's generally unnecessary. If you grew up in the days of Windows 2K or XP, you're probably thinking of a firewall as something necessary to protect the vulnerable innards of the OS from various malefactors on the Internet, but macOS (and modern versions of Windows) just don't expose their innards in the first place. Turning on the firewall sort-of adds a layer of protection, but it's protecting exactly zero exposed services, so it's kind of irrelevant.

Ok, I'm oversimplifying a bit. There are some services that macOS exposes by default, but they're things that're kind of needed for local network operation, like service discovery and name lookup (both Apple's preferred Bonjour/mDNS, and Windowsey NBNS), so the firewall lets them through anyway. If you click Firewall Options, it has an option to "Block all incoming connections" ... "except those required for basic Internet services, such as DHCP, Bonjour, and IPSec."

What the macOS firewall really does is give you a layer of administrative control over which programs are allowed to provide (/expose) services on your Mac. My favorite example is old versions of MS Office programs that opened ports so they could communicate with other instances on the local net to look for duplicate serial numbers. It doesn't tell you it's going to do this, or (of course) allow you to turn it off, and who knows how secure it is. But with the firewall on, that will ask if you want to allow it, and if you don't, the firewall will block incoming connections to that software.

So the real point is: do you trust the software you're running? Do you trust the software your kids are running? If not, the firewall is for you. However, the default is to trust anything built in (e.g. services turned on in the Services preference pane) and signed programs (enh...). Take a look at that Firewall Options dialog, and change anything you don't like.

BTW, in my experience the "Stealth mode" option mostly makes network troubleshooting harder, but if you aren't into network troubleshooting you might be ok with that.

BTW2, one thing the built-in firewall doesn't do is filter outgoing connections. If you want control over which programs are allowed to connect out, look at third-party options like Little Snitch and LuLu.