[subego]

Hi everybody!

I've searched for the answer to this stupid question, but apparently it's so stupid no one has committed it to print.

Just what the heck is the OS X firewall doing?

I assume if a service is disabled, there's no need to block that/those port(s) as any attempted communication would be ignored.

So you enable a single service. Okay. So what has changed? What is the firewall doing? Blocking communication to disabled services?

I'm sure I'm just missing something here, and would greatly appreciate someone screwing my head on right about this.

[Cadaver]

The firewall does at least one thing - instead of the OS reporting the port as "closed" to port scans (closed, but at least acknowledging that a computer is present), the firewall wont report one way or another. This will make it look to the outside world like there isn't a computer at that port at all.

Safer for you... hackers wont target a machine they don't know exists.

[subego]

Makes sense.

Thank you!

[kampl]

From Terminal.app, sudo ipfw print . This is what your firewall is allowing and blocking. IPFW operates on a first match basis not a best match basis so the ordering of the rules is very important.