MacMost Now 376: Snow Leopard Firewall

Hi, this is Gary with MacMost Now. In today's episode, let's look at the Snow Leopard firewall.

So I've gotten a few questions recently about the firewall built into Leopard and Snow Leopard. People want to know if they should use it and what it is for. Let's take a closer look.

You can find the firewall in System Preferences under Security. Click on the third tab, which is the firewall tab. You can see there, by default, it's usually turned off. You can click Start to turn it on, but you're going to have to unlock it by entering in your password. And of course you have to have an admin account to do that. Click Start and now we've got the firewall going. 

Right away you may get some notifications here. I've got some applications that want to use the firewall so I'll go through it. I'll allow those because I know both those applications; I installed them. And now the firewall is off and running.

Now to dig down in the firewall we click the Advanced button and we come up with this list that shows what is allowed to go through the firewall. So basically, turning on the firewall, which is blocking all connections, really doesn't do you much good because you're probably going to want to access the Internet, check your email, and surf the web. This will show you what gets through it.

You've got your basic things like file sharing, screen sharing, and web sharing. They're all turned on because I've enabled those services on my Mac. Obviously the Mac assumes that I don't want to disable them by turning on the firewall. I can go and disable each one of those under Sharing and it will automatically turn-off here in firewall as well.

And then I've got a bunch of other things here listed that have tried to go through the firewall, and whether or not they're allowed to. I can change whether they're allowed to by simply clicking here and choosing allow or block. This list will grow as you run applications that use more and more services over the Internet. You'll get prompted, just like I did before, whether or not they should go through. You could also add your own here. Click and add applications or you can select one and remove it from the firewall.

Now one of the things people really mean when they talk about firewalls is blocking all unwanted connections when they're on public wifi or something. That is done with this big check box here, right at the top. If I click that, basically what it does is it shuts down all of the ports on my Mac except for the ones that are obviously used for regular things, like Internet services or surfing the web. 

One practice a lot of people do with their portable Macs is to check off this whenever they're in a situation where they're using public wifi. So maybe just before they travel or when they setup their laptop at a coffee shop; immediately go into firewall, check this off and then just surf the web and not use any of the other services they might normally use at home.

So what exactly does firewall do? Well, people love to use analogies when talking about firewall. They talk about their Mac's like a house, and you've got ports like windows and doors and things can come in and out of them. Well, I like to think of it more like an office building. Your office building has one address; that's like your IP address. But, inside of it, there are different areas of the office building that do different things. For instance, there may be a mailroom, a public relations firm, a real estate firm, all these different companies in there, and they each have individual suite numbers inside the office building. 

That's kind of like ports on your Mac and the ports are used for different things. One port, like port 80, might be used for web surfing. Another port might be used for getting email and another port might be used for iChat. 

Now a traditional firewall would block off ports. So say if you would close a specific port, or a whole range of ports and then try to chat, you might not be able to chat because the port used by that chat application has been closed. Snow Leopard takes a different approach and actually closes off the ports according to application. Instead of worrying about what port number iChat uses, you can simply allow iChat to have access over the firewall and your Mac will figure out automatically which ports need to be opened for that application and close off things that aren't needed.

So, is there danger? Well, danger theoretically exists if you've got all your ports, or a lot of ports open and you have a public IP address. This means the IP address of your Mac is actually open to the world. Somebody goes to that IP address from somewhere else in the world and they get your Mac.

Now this isn't typical if you were at home. If you have a cable modem, or DSL, or even if you're at work, you have a local IP address for your house or building and the public IP address is something that is handled by the network, say your router or your DSL or cable modem. In that case, it's already got kind of a firewall built-in to that modem that prevents people from accessing your Mac from outside.

But this may not necessarily be true if you're on public wifi. First of all, your local IP address on a public wifi network is available to other people on that same public network. So if you're using, say, an IP address at a conference center there might be hundreds of other people on that local network that may be able to go and see your machine.

The same thing is true if you have a static IP address for your Mac or happen to be assigned a temporary IP address that is not a local one, but can be accessed from anywhere in the world. This is rare, but if it does happen somebody can actually go to that IP address and try to use an application on a port.

So, the thing is that the analogy of a house with doors and windows open is not really good for firewalls and ports on your machine because if a door is open somebody can walk in. Well, it's not really true with a port. See, there's got to be something on the other side for them to communicate with. For instance, if it's a port used for chat, there's got to be a chat application running for them to go in and chat with you. 

If somebody from the outside wants to come to your Mac, just simply having an open port is not going to allow them to do that. However, if there's a backdoor way for them to communicate with something already running on your system that allows them to get into your Mac, then you could have a security problem

So that's easy to say, but the truth is that it's only a theoretical problem. There's really no way for a hacker to come in to an open port on your Mac and get access to your Mac; at least none that I could find on any website or reported by anybody. It's a theoretical problem, and one that you could basically take the theory out of completely by turning on firewall and blocking all your unused ports.

Think of firewall as more of a safety precaution; not really a necessity. You may want to just forget about it or you may want to go ahead and turn on the firewall option, which blocks almost all incoming connections, while you're outside of your house or outside of work.

But there's kind of a trap here. You see, some people notice that if they take their Mac on somebody else's network and they have sharing turned on, that the other person can see their shared folders. They think the way to stop that is turning firewall on, but that won't work. What happens if you turn firewall on, but you have file sharing still turned on, then, simply, firewall will allow sharing to go through because you've turned it on. The way to stop somebody from seeing your shared folders on a network is to turn off file sharing, at least temporarily while you're on that other network, and then the firewall doesn't matter. Your file sharing is turned off; there's nothing for them to see even if you're machine is on the same network as them and your firewall is off.

So, to sum up, if you're very concerned about security and you're on some sort of public network or network shared by people other than people in your household, then you may want to turn file sharing off, as just a precaution. If you've never really though about it before and you're not to worried about it, then don't worry about it now. A lot of people go years and years without turning their firewall on. I certainly don't use it on the machines in my house. There's no way for anybody from the outside to get to them and I trust all the Macs that are in my house and my office.

I'd love for this video to be the start of a discussion about firewall and its usefulness. You can post comments on this video on http://www.MacMost.com and add to the discussion. 

Til next time, this is Gary Rosenzweig with MacMost Now.