{"id":44972,"date":"2024-09-18T13:51:01","date_gmt":"2024-09-18T17:51:01","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=44972"},"modified":"2024-09-25T15:32:13","modified_gmt":"2024-09-25T19:32:13","slug":"macos-firewall-regressions-in-sequoia","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2024\/09\/18\/macos-firewall-regressions-in-sequoia\/","title":{"rendered":"macOS Firewall Regressions in Sequoia"},"content":{"rendered":"

Will Dormann<\/a>:<\/p>\n

[Running] nslookup<\/code> clearly causes a DNS request and a response to go over the wire, but nslookup<\/code> eventually gives up thinking that no servers could be reached.<\/p>

[…]<\/p>

So if I turn off the macOS firewall, this all works fine. 🤔<\/p>

[…]<\/p>

Problem #1: “Block incoming connections” includes DNS responses is new as of macOS Sequoia. Prior to macOS 15 Sequoia “Block incoming connections” meant “Don’t poke a hole in my firewall for this”. Starting with Sequoia, this also includes “Don’t allow responses to DNS requests”, which is clearly a bug in the macOS stateful firewall. Any response to a request that I initiate should be allowed in.<\/p>

Problem #2: The macOS GUI for firewall rules being disconnected from the existing rules (e.g. cannot change some) is apparently an artifact of macOS switching underlying storage for the firewall rules at some point. And the GUI apparently is only hooked up to the old storage. If you’ve had a Mac for a while, you’ll probably get bitten by this.<\/p><\/blockquote>\n\n

Wacław Jacek<\/a>:<\/p>\n

\n

It seems the OS firewall can sometimes start blocking access to web browsing after upgrading to macOS Sequoia. At least this was the case for me and some folks on Reddit.<\/p>\n

Going to the firewall settings screen, there can be no way to toggle access for the browser.<\/p>\n<\/blockquote>\n\n

Ivo Damjanović<\/a>:<\/p>\n

\n

I have an issue with the firewall too. It does not accept incoming SSH connections. But they are allowed. I think this is a bug. I can tell you how to edit the entry list. You are able to edit some of them because the UI uses an old firewall rule storage. You can not edit the rules that use the new storage. You may edit them with sudo \/usr\/libexec\/ApplicationFirewall\/socketfilterfw --listapps<\/code>.<\/p>\n<\/blockquote>\n\n

I’m also hearing that firewall and other security and networking settings were silently reverted by the Sequoia update.<\/p>\n\n

See also: MacRumors<\/a>, Reddit<\/a>, ESET<\/a>.<\/p>\n\n

Previously:<\/p>\n