You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

User profile for user: Oliver Breidenbach
Oliver Breidenbach Author
User level: Level 1
8 points

Firewall in Sequoia now a security risk

In MacOS Sequoia, if the firewall is set to "Block all incoming traffic" it also turns off the services.


My security concept was to use Cloudflared to provide secure access via Cloudflare's Zero Trust system. This worked in Sonoma because I could access the Screen Sharing service locally.


How this works is that Cloudflared is using an OUTGOING connection to connect to my private network. Once that is established, I could access the services on the Mac through the tunnel, but to the outside world, the computer was invisible as it doesn't respond to any requests. This now no longer works. I now have to enable external access to Screen Sharing for the Screen Sharing to work through the tunnel, something which I would consider a security risk.


Does anyone know a good tool to manually configure the MacOS firewall so that I can still block all connections but have the sharing services running for localhost access?

Mac mini

Posted on Nov 25, 2024 1:18 PM

Reply
Question marked as Top-ranking reply
User profile for user: etresoft
etresoft
User level: Level 9
51,096 points

Posted on Nov 25, 2024 1:39 PM

The application firewall doesn't do anything by default. Or at least, it didn't use to do anything. Now it breaks lots of 3rd party software in Sequoia, while otherwise not doing anything.


Now if you've configured the built-in firewall to actually block something, and some UI bug doesn't turn that off when you aren't looking, then it will do that. This is why I say the firewall doesn't do anything by default. If it's allowing connections, then it isn't doing anything.


Unless you have your Mac jacked right into a switching up on the internet, then you actually aren't on the internet. Your ISP router is on the internet. Your built-in firewall is protecting your Mac from your iPhone or maybe your printer. So just turn it off as it isn't needed. That will solve your problem.

View in context
5 replies
Question marked as Top-ranking reply
User profile for user: etresoft
etresoft
User level: Level 9
51,096 points

Nov 25, 2024 1:39 PM in response to Oliver Breidenbach

The application firewall doesn't do anything by default. Or at least, it didn't use to do anything. Now it breaks lots of 3rd party software in Sequoia, while otherwise not doing anything.


Now if you've configured the built-in firewall to actually block something, and some UI bug doesn't turn that off when you aren't looking, then it will do that. This is why I say the firewall doesn't do anything by default. If it's allowing connections, then it isn't doing anything.


Unless you have your Mac jacked right into a switching up on the internet, then you actually aren't on the internet. Your ISP router is on the internet. Your built-in firewall is protecting your Mac from your iPhone or maybe your printer. So just turn it off as it isn't needed. That will solve your problem.

Reply
User profile for user: Oliver Breidenbach
Oliver Breidenbach Author
User level: Level 1
8 points

Nov 26, 2024 12:35 AM in response to etresoft

Thanks for your response. Since the Mac is hosted at the ISP and has a public IP address, I need the built-in firewall. There is an "external" firewall available but that doesn't screen the Mac from the other computers hosted there. Opening the Screen Share port on the local firewall makes it accessible to the other computers in the rack, so doing that will solve half the problem. I really want to lock it down so it is ONLY accessible via the Cloudflare Zero Trust tunnel. And I might add that this was possible in MacOS Sonoma.

Reply
User profile for user: Zurarczurx
Zurarczurx
User level: Level 2
428 points

Nov 26, 2024 12:50 AM in response to Oliver Breidenbach

I didn't realize you wanted to firewall from LAN too. Can't you put the Mac on a separate LAN from the other computers in the rack and then use the router's firewall? You've got a pretty special set of requirements and the Mac's firewall is a bit of a big-button feature phone when it comes to customization. Unless you're using the one provided by your ISP, most routers have pretty good firewalls and LAN management. Mine can block by IP range WAN to LAN, LAN to WAN and LAN to LAN and include specific websites. I think it can also block by application, but I've never used that.

Reply

Firewall in Sequoia now a security risk

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.
Learn more Sign up