[kman42]

Since the other thread got hijacked, I thought I would post this new info here. At least, I think it is new.

Mac OS X 10.5: About the Application Firewall

[Don Pickett]

I can't get my ipfw settings to stick between restarts.

[wobbly]

this sounds like it would make LittleSnitch redundant. Is that true? Does it give you the ability to block

-any network connection
-local network connection
-broadcast
-multicast

while also selecting a ports (or port range) and the protocols (UDP, TCP, any, etc.)

can someone clarify who has used the new feature of leopard and little snitch how they compare? thanks!

[Don Pickett]

Originally Posted by wobbly 

this sounds like it would make LittleSnitch redundant. Is that true? Does it give you the ability to block

-any network connection
-local network connection
-broadcast
-multicast

while also selecting a ports (or port range) and the protocols (UDP, TCP, any, etc.)

can someone clarify who has used the new feature of leopard and little snitch how they compare? thanks!

The Application Firewall in 10.5 is an either/or proposition. You either block all access to an application, or allow all.

[wobbly]

thanks! a bit dissapointing. From what i can see LIttle Snitch isn't available yet for Leopard only a beta version.

[CharlesS]

Little Snitch is for outgoing traffic. Leopard's Application Firewall is for incoming traffic. The two don't overlap at all.

Leopard's application firewall also gives you no control over port numbers, and according to recent reports, lets certain ports through even if you tell it to block all incoming connections. I wouldn't bother with it, and would put your Mac behind a router or other hardware firewall instead so that you know your ports are blocked.

[OAW]

The problem with the Set access for specific services and applications setting is that the user has no idea what the DEFAULT BEHAVIOR is. Here's a simple scenario ....

I enable this setting in the firewall and add no applications to the list whatsoever. The million dollar question is are incoming connections blocked or not? If so, then that should be documented somewhere. And if not, then the protection is pretty weak since it doesn't exist until you happen to launch or manually configure various applications on your machine. And what happens if the incoming traffic isn't application specific?

Unfortunately, this linked document on the Apple Support site still doesn't address these fundamental issues.

OAW