Firewall in Sequoia now a security risk

The application firewall doesn't do anything by default. Or at least, it didn't use to do anything. Now it breaks lots of 3rd party software in Sequoia, while otherwise not doing anything.

Now if you've configured the built-in firewall to actually block something, and some UI bug doesn't turn that off when you aren't looking, then it will do that. This is why I say the firewall doesn't do anything by default. If it's allowing connections, then it isn't doing anything.

Unless you have your Mac jacked right into a switching up on the internet, then you actually aren't on the internet. Your ISP router is on the internet. Your built-in firewall is protecting your Mac from your iPhone or maybe your printer. So just turn it off as it isn't needed. That will solve your problem.

I didn't realize you wanted to firewall from LAN too. Can't you put the Mac on a separate LAN from the other computers in the rack and then use the router's firewall? You've got a pretty special set of requirements and the Mac's firewall is a bit of a big-button feature phone when it comes to customization. Unless you're using the one provided by your ISP, most routers have pretty good firewalls and LAN management. Mine can block by IP range WAN to LAN, LAN to WAN and LAN to LAN and include specific websites. I think it can also block by application, but I've never used that.

Oliver Breidenbach wrote:

Since the Mac is hosted at the ISP and has a public IP address, I need the built-in firewall. There is an "external" firewall available but that doesn't screen the Mac from the other computers hosted there. Opening the Screen Share port on the local firewall makes it accessible to the other computers in the rack, so doing that will solve half the problem. I really want to lock it down so it is ONLY accessible via the Cloudflare Zero Trust tunnel. And I might add that this was possible in MacOS Sonoma.

The Mac is a consumer device. It's not designed for that kind of use. I don't recommend trying to fix it with 3rd party consumer software either, because that also wasn't designed for that kind of use.

Turn off the built-in firewall. That's not what you want. Instead, do some research on the built-in packet filter system. Look at the "pfctl" and "pf.conf" man pages.

There were some really low-level networking changes in Sequoia. You'll have to do some testing and you can't rely on anything the internet says about it. None of that may be true for Sequoia.

And you should also consider not bothering. There are plenty of Mac hosting services and their default configurations allow external connections. The built-in services are secure with good passwords. Even if this is your own computer, you still have to treat it like a hosted system. If you try to secure it too much, you'll find yourself locked out and having to pay extra for someone at the data centre to fix it for you.

You can manage incoming and outgoing connections by process.

Has your router got a firewall?

Little Snitch? I've just checked and you can set up rules by process and LAN addresses.