Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm wondering if references referring to pf in FreeBSD are applicable to ipfw in Mac OS X Snow Leopard? I'd like to know to see if it's worthwhile to consult books on pf for use with Mac OS.

share|improve this question

ipfw is like as ipfw on freebsd. :)

ipfw and pf are totally different packet filtering systems. ipfw is the old BSD (Internet Protocol Firewall), and pf (packet filter) comes from the OpenBSD.

pf is much much more powerful as ipfw. In fact, pf is much more powerful as anything other. Here is too much differences, but the main "philosophical one" is:

  • In IPFW, the first rule in a ruleset what matches a packet "wins" - and next rulesets are not evaluated
  • In the PF the packet is matched with all rules and the last rule that matches the packet "wins".

You should consult books, manuals about the "ipfw", not pf.

Btw, here are two nice free applications: NoobProof and WaterRoof - both are helpers for the OSX's ipfw.

share|improve this answer
Can you please elaborate a bit why PF method is better? – Peter Štibraný Jun 9 '11 at 7:40
PF is an totally different subsystem. PF has integrated NAT, QoS and much more. With ipfw for these must install additional packages, what isn't a big deal, but it is always good, having all packet-things on one consistent place. PF rulesets are shorter and more powerful. PF is generally faster than IPFW. Here are zilion small things what causes than using PF is more pleasant as IPFW. (e.g. pfsync with witch you can sync multiple firewalls an much more.) But don't understand me wrong: IPFW is an excellent packet filter. Simply, the PF is in another league. (Stačí? :-) - no chars left). – jm666 Jun 9 '11 at 11:57
Díky :-) I was mostly curious about difference of "first rule wins" vs "last rule wins". I read your answer as if this was big difference, but I didn't understand why it would be. Now I see you prefer PF due to other things, not just rule evaluation. Thanks. – Peter Štibraný Jun 9 '11 at 12:34
Ahh, understand. That has advantage too. Imagine: in PF the default state is "deny everything". So, you're secure. And you with the next rules step-by-step allowing passing some packets. In contrast in IPFW, the default state is open and the "deny everything is usually the last rule". It is ok too, but it is easier make a mistake and a bit harder to configure. – jm666 Jun 9 '11 at 13:29
@Peter - Thanks for your detailed replies! Is it possible to run pf on Mac OS X 10.6.7 ? – Scott Davies Jun 10 '11 at 13:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.