Firewall manipulation

Question

How can I enable the firewall on a 10.4 client machine via the command-line ? Where are the default rules stored? Thanks.

Answer 1

Hi Mihalis,
   Ah! Now I see where you've been hiding. Well, you can't keep it all to yourself no mo'. (silly jokes, of course) I didn't know about this topic. It seems that you discuss some interesting issues over here.
Hi Trent,
   You'll be glad to know that it doesn't matter what you do in the Firewall tab of the Sharing System PrefPane. If you have your own rules in place, Apple's Firewall mechanism will refuse to interfere. When I click on the Firewall tab I get a warning sheet saying, "Other firewall software is running on your computer" and it will refuse to interfere. (all buttons are "grayed-out") Thus if you implement your own firewall, Apple's software will respect your choice.
   I highly recommend doing your own firewall. Apple's firewall mechanism is impressive but it's not possible for it to be aware of your network topology and special needs. Thus if you're knowledgeable, you can generally do better than Apple's generic rules. However, study is recommended. One of my first encounters with single user mode was the consequence of a stupid attempt at personally configuring my firewall.
   Here are some links to pages that will help you implement your own firewall configuration. First, the FreeBSD manual:
FreeBSD Handbook:Chapter 24 Firewalls
Then the O'Reilly ONLamp articles:
http://www.onlamp.com/pub/a/bsd/2001/04/25/FreeBSD_Basics.html
http://www.onlamp.com/pub/a/bsd/2001/05/09/FreeBSD_Basics.html
http://www.onlamp.com/pub/a/bsd/2001/06/01/FreeBSD_Basics.html
http://www.onlamp.com/pub/a/bsd/2001/06/21/FreeBSD_Basics.html
The following site discusses Mac firewall products.
http://seaotter.berkeley.edu/cab/mac-firewalls/
More important, the above page has a link to an archive of Stefan Arentz's article, formerly at http://wopr.norad.org/articles/firewall/, that is specific to OS X. Unfortunately that archive no longer exists but I have the article myself. If I can get Stefan's permission, I may publish it myself.
   I keep my rules in a script that is executed at boot by a StartupItem. Postings on "the other UNIX discussion" suggest that launchd wouldn't be appropriate for this task. I've put my StartupItem and a select subset of my rules on the web at firewall.tgz. Hopefully the rules and script will give you an idea of some of the things you can do. I haven't updated that posting in a while though so I recommend testing before using it. I don't know the status of the Tiger firewall bug but when Tiger was first released, dynamic rules caused a multiprocessor machine to eventually freeze.
Gary
~~~~
   Be wary of strong drink. It can make you shoot at tax
   collectors ... and miss.
         -- Lazarus Long, "Time Enough for Love"