I'm trying to determine what Apple's Firewall considers essential services. Apple's Firewall has the following settings available:

enter image description here

A search of Apple's site does not reveal a support document on the topic: http://www.google.com/search?q=firewall+"essential+services"+site:apple.com.

What are the services Apple's Firewall considers essential? And which of those services will be allowed to receive incoming connections, and make outbound connections?

  • Not really an answer, but this Macworld article says:"If you’d like to block all nonessential traffic, you can select Allow Only Essential Services, but beware: doing so will break some applications. You’ll still be able to browse the Web and use e-mail, but other inbound connections will be blocked." – sbolel Aug 23 '15 at 2:28

Essential services are those in the Core Services layer. When that option is checked, only the incoming connections to the below services will be allowed:

From https://developer.apple.com/library/mac/documentation/MacOSX/Conceptual/OSX_Technology_Overview/CoreServicesLayer/CoreServicesLayer.html

The technologies in the Core Services layer are called core services because they provide essential services to apps but have no direct bearing on the app’s user interface.

Some of the notable core services are

  • accounts & Social media integration
  • identity service
  • time machine
  • keychain services
  • notifications
  • iCloud storage
  • cloudkit
  • file coordination
  • bundles and packages
  • internalization/localization
  • bonjour
  • security services
  • address book

And from http://www.macworld.com/article/1131116/firewall.html#configure

The second option, “Allow only essential services,” will block anything except a few default services that support networking, such as Bonjour. Only use this option if you want to block everything; this will prevent any file sharing, remote access, or other services activated elsewhere on your Mac.

You can switch your firewall settings and run nettop in Terminal to monitor the network activity of each process that is running.

  • 2
    Oh, man... that's worse than I expected; like why is the Keychain responding to incoming requests. I'll have a few more questions now that I need to tune that list... – user83961 Aug 23 '15 at 3:46
  • To be honest, after looking into this, I also have more questions. – sbolel Aug 23 '15 at 3:49
  • 1
    @jww Just because a service is a core service doesn't mean that it will have network functionality ;-) Or maybe I just misunderstood your comment. – David Mulder Aug 23 '15 at 4:36
  • Thanks David. I'm going to back off on accepting this answer. Sorry about that, Sinan. – user83961 Aug 23 '15 at 4:47
  • No problem! I learned something as well :) – sbolel Aug 23 '15 at 7:50

You must log in to answer this question.