4

Is ipfw available in Mountain Lion? The reason for asking is that they introduced pf in Lion, but kept ipfw, however there is a chance that ipfw would eventually be removed.

I found this: Can I use ipfw on OSX 10.8 (Mountain Lion), but that was asked before releasing Mountain Lion and there is no answer.

Improve this question

1 Answer 1

Reset to default
8

Yes it is. I use it for my firewall needs. A great way to test if it still exists, is to just run it. Open Terminal.app and enter the following command:

sudo ipfw list

It should report the following (rules may vary):

65535 allow ip from any to any

Additionally, Apple will not remove it as it is actually the backend for the default Application Firewall found in System Preferences, at least not for some time.

You can read up more on ipfw in OS X using Apple's Manual Page (or simply type man ipfw in Terminal.app).

As for pf (the actual implementation of OS X is pfctl), it is a much more object orientated program that can control network access translation and packet filter (while ipfw requires external components to handle them). It is born from OpenBSD (as opposed to FreeBSD) and has been around for quite a while as well. It's power comes from being able to accomplish more internally, but also optimize long rulesets (that sometimes bogs ipfw down). They are both, however, excellent firewalls and can coexist quite happily. You can read more about the differences between pf and ipfw, here.

Improve this answer
4
  • Thanks. I didn't upgrade to Mountain Lion yet, that's why I am asking if it is still there. As for ipfw and the application firewall, they may decide to use pf as backend at some point; from what I understand pf is newer, more flexible etc. and that's why they put it there.
    – lupincho
    Commented Jul 28, 2012 at 20:52
  • @lupincho Yes, I understand. Even if Apple moves to pf, they can still continue bundling ipfw in OS X (perhaps simply opting not to update the program at every iteration). In any case, ipfw has survived the chopping block for at least another major iteration :)
    – user10355
    Commented Jul 28, 2012 at 20:57
  • I tried turning on the application firewall. The output of ipfw list didn't change, though. This appears to contradict your assertion that ipfw is the backend for the application firewall. How come?
    – Harald Hanche-Olsen
    Commented Nov 11, 2012 at 13:38
  • → Harald: Cksum is right. On a newly installed mountain Lion, /usr/bin/sudo ipfw list will show you that the command ipfw exists and that its filtering mechanism is active within the kernel as a fully open backend. I got the same output as the one shown by Cksum.
    – athena
    Commented Oct 29, 2013 at 16:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .