0
1
I have a MacBook Pro with the firewall on. I'm trying to run a Wireshark trace and the noise bleeding through Apple's firewall is very distracting. According to the image below, most of this noise is supposed to be blocked.
In practice, I'm finding a lot of Bonjour/mDNS/uPNP traffic getting through. I'd like to shut it down too.
Apple's docs don't really list anything useful for controlling the firewall. For example, there is no firewall(8)
and ipfirewall(4)
is a programming interface:
$ man -k firewall
ip6fw(8) - controlling utility for IPv6 firewall (DEPRECATED)
ipfirewall(4) - IP packet filter and traffic accounting
ipfw(8) - IP firewall and traffic shaper control program (DEPRECATED)
How does one block all uninitiated inbound traffic, including promiscuous protocols like Bonjour? (I probably need to block outbound traffic too, but I can probably figure it out once I learn how to work with the firewall).
This just made my radar (I'm not sure how I missed it). Where does the ruleset go on Apple systems? Also, I'd like to allow SSH only since I need to SSH into it on occasion. I'd like it to be in effect upon system start. – jww – 2016-08-08T03:39:22.060
Looks like there's a lot of great detail here: https://pleiades.ucsc.edu/hyades/PF_on_Mac_OS_X You might also look into a GUI for PF config like IceFloor http://www.hanynet.com/icefloor/index.html or Murus (linked therefrom).
– Jeremy W. Sherman – 2016-08-08T13:20:24.950