A lot has been written and spoken about the Leopard Firewall and the differences between it and the Tiger Firewall. For one thing, the new firewall appears to ignore the long used freebsd based ipfw firewall and instead someone at apple decided they should roll their own. Please note that ipfw is still included in Leopard, it just isn’t used by default, and the system preference panes relating to the firewall are for the new one, not ipfw.
The main differences the computer user will notice are that the firewall’s been moved from the sharing preference pane as it is in Tiger, to the security preference pane in Leopard, and that the firewall uses a different model for configuring what gets through and what doesn’t. This is all dandy, and you may wonder why I’m bringing it up now. Well, it’s because the 10.5.1 update patch slightly changed the verbiage in the firewall preference pane, which I thought I’d point out.
Also be aware that when upgrading from Tiger to Leopard, regardless of what firewall settings you had by default, the firewall appears to be disabled in Leopard by default.
In Tiger, the Firewall was located in the sharing preference pane, and worked by allowing you to select services or ports to open or close, based on the services you wanted to run on your mac.

In addition, the services section of the sharing preference pane would also have an effect on the firewall, such as when enabling remote desktop, which would also then enable this service for the firewall.

In Leopard, click on the security preference pane instead of the sharing pane to get to the firewall.

Clicking on the firewall section of the security pref pane shows that the new firewall is configured differently: Allow all incoming connections, Allow only essential services (in 10.5.0, this was “Block all incoming connections,” which was misleading), and Set access for specific services and applications.

Choosing the last option means that you’ll set, app by app, allow or block status for things you specifically want to let through or to block.

Finally, the firewall also allows logging and stealth mode (where the firewall won’t let the mac respond to pings, etc).

The main problems with the new Leopard firewall are well detailed but the main ones were the fact it was disabled by default, the fact that even with it set to use only essential services, some things are not blocked which you won’t really be able to change, and then the fact that the firewall would code sign apps when you listed them even if they weren’t code signed previously. This breaks apps that change their signature as they run, which meant that some people found skype broken as a result of this.
I think the jury is still out on whether or not the firewall is a huge mistake or will be just fine once apple tweaks it a little. it’s just important for the person moving from Tiger to Leopard to know that it is different, and what those differences mean.
I personally prefer the services based approach of the Tiger firewall to the app based approach of the Leopard firewall, and it also appears that ipfw as implemented in Tiger had a lot fewer rough edges than the new firewall does.
More on Leopard Firewall:
Tidbits article
securosis.com article
Apple’s article on the 10.5.1 update
Technorati Tags:
apple, computers, leopard, security