Mac OS X Lion Firewalls

Mac OS X Lion has three firewalls.

1. IPFW: the original firewall, deprecated and being replaced
2. PF: the new firewall
3. ALF: the application layer firewall configured in System Preferences

There is another significant firewall tool included in Mac OS X Server. It is afctl the automatic host blocking utility. It automatically creates firewall rules to temporarily block attacking hosts. It appears to create rules in ipfw.

The Apple Man Page is available.

The afctl executable is a link in /usr/libexec to /System/Library/CoreServices/AdaptiveFirewall.bundle/Contents/MacOS/afctl.

The files involved are:

 /System/Library/CoreServices/AdaptiveFirewall.bundle/Contents
 /usr/libexec/afctl
 /System/Library/LaunchDaemons/com.apple.afctl.plist
 /etc/af.plist
 /var/run/af_state
 /var/db/af/whitelist
 /var/db/af/blackliet

Reference good article at Krypted