Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Snow Leopard has in its Security Panel a Firewall option, which is off by default. That means (according to the help message there) that all incoming connections to the computer are allowed.

Can/should I turn it on? What kind of applications would that break?

Conversely, am I at risk at an Internet cafe when I do not turn the firewall on (assuming that all sharing features are disabled either way)?

Also, what about outgoing connections, can they be filtered, too?

share|improve this question

I'd suggest turning it on regardless of what it "breaks". You can tell if one of your apps is being blocked and quickly make an exception for it easily. The firewall can filter incoming and outgoing connections, depending on how you want it configured. For more advanced configuration, grab a copy of Waterroof (a frontend for ipfw). Better safe than sorry.

share|improve this answer
Why is it off by default, then? – Thilo Nov 27 '09 at 9:40
Because all network communication ports are blocked by default, and all network services are turned off. But if you turn on a service such as sshd you open yourself up to attacks. – John T Nov 27 '09 at 9:45

I just want to re-emphasise what John T commented on - it is off by default because there are no shared services by default. Therefore if you have changed the default settings and have services with ports open, then I would always turn the firewall on. Note that there is more than one firewall, the one accessible through system prefs is an application-centric one, but there is an additional ipfw based one which, as John T mentions, is configurable using Waterroof, or they have a simpler NoobProof GUI too (you can hack at it using the terminal if so inclined).

I would also recommend an outgoing connection firewall like Little Snitch, as the Application firewall and ipfw are traditionally incoming-only firewalls. Not sure if you can hack ipfw to do reliable outbound checking...

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .