If you do not turn on any of the services found in the 'Sharing' pane of System Preferences, there is really no need to turn on the Firewall except for peace of mind.Īlso, application firewalls, such as the one found in the 'Security' pane, typically only understand the protocols for sharing services (VNC, FTP, SSH, etc) if used on the standard port for the service and provide only basic filtering for non-standard protocols or services using non-standard ports. Given the sandboxing of mandatorily exposed services combined with other remotely accessible services being turned off, Mac OS X is firewalled by default even though it does not ship with the conventional application firewall turned on. Often this type of sandboxing, when used to supplement Unix DAC, is labelled as an application firewall for example, AppArmour (found in some Linux OSes) is referred to as an application firewall (also by default only used for mandatorily exposed services). This is used to sandbox mandatorily exposed services, such as mdnsresponder. Sandboxing in Mac OS X is an implementation of the TrustedBSD MAC model. Sandboxing also constitutes a form of firewalling.

This is supplemented by Unix permissions and access control lists. The Unix DAC model insulates different levels of the system by controlling access based on users and groups.

But, firewalling constitutes more than just an application firewall or a packet filter. In terms of the common understanding of a firewall, Mac OS X is not running any firewall by default.

Mac firewall on or off