In the past I have always run a NAT router between my Windows PC's and the internet. I'm wondering if I still need this or whether the OSX firewall is good enough to let me put a Mac directly on the internet.
Though I don't mind hooking up my Mac to any network, I don't have the definitive answer. Still, some notes too long for a comment:
The OS X built-in firewall is an application firewall: accepting incoming connections is granted per application, not per port. Once granted permission, an application could open any port it likes, but I guess that's not an issue for software you trust. Also, it only applies to incoming connections: all outgoing connections are always allowed (but that is true for a NAT-firewall as well). And according to Apple's "Mac OS X 10.5 Leopard: About the Application Firewall":
In 10.6 the latter is made more explicit (and can be disabled) as "Automatically allow signed software to receive incoming connections. Allows software signed by a valid certificate authority to provide services accessed from the network.":
Hence, even when the firewall is active, every server-like Apple application that you have running is, by default, allowed to accept incoming connections. (Or, maybe in 10.6 it even applies to any signed application?) A bug in such software could compromise your computer. I don't know how that affects things like Bonjour and file sharing.
If the firewall is active then any non-Apple software (or at least unsigned software) first needs your permission to accept incoming connections. When such software is updated, it might or might not need your permission again:
It is not safe to put anything on the internet. Having said that, nowadays most people connect to the internet behind a router, which also tend to implement firwalls and whatever else, so you could be using win95 without a hitch.
It all depends on what you do with that computer and if you are only browsing the internet or are serving content. Can't answer anything more specific without further details.
Of course one could go on about how in theory nothing is safe, ever, and all that.
But for practical purposes, yes, it's generally safe enough to put your Mac directly on the internet. (Everyone does it – well, most people in any case – and it's very unlikely anything bad will happen to you.) Especially if you do not open any extra services (like httpd, etc) on your machine.
That said, do (let the automatic updater) keep your Mac OS X always up-to-date with latest security fixes, and check that its built-in firewall is enabled.
Considering you're not be running something like IE6 out of the box (unlike a fresh XP install for example) you should be fine.
As always, it's what you DO on the internet which ultimately effects the security of your system. If you're downloading lots of files from lots of sources and clicking every link that comes your way then you're at a higher risk (of course, if you take the right security precautions you'll be right)
As the others have said, nothing on the internet is technically 100% safe. Mac's are less vulnerable... but by no means invulnerable.
It's never secure to connect a computer to the internet, and it's always better to have a router in between.
Since most routers run embedded-Linux, it's most-likely more secure to have them in-between.
Speaking as a Linux-user: Mac OSX has most of the applications from FreeBSD, so make absolutely sure you have ssh and sshfs not installed or running, if you don't need them.
And just having a firewall is not enough. Make sure it's properly configured.
I have a NAT ADSL connection at home and a 3G service for away. While on 3G I have noticed
Have a look to see what services you are running.
This is an abbreviated list of what I am running. You can see
Most services are listening on all interfaces (*.). In my case I should fixup my
Are there services you don't want running?
In my case, i'm not sure why I am sharing files via samba (139/445) so I'll turn that off.
I can't see how to turn off
I now just have these running.
Someone mentioned that most people are behind a NAT firewall. This is probably true if you have a router, but check that NAT is turned on.
But on a 3G service you are directly connected so you should be careful. I haven't been, so this was a good question to make me review my settings.
Other things to do.
Remember, if a service is not running, no one can get in. So the fewer ports that are opened the better.