Firewall: stealth mode vs non-stealth mode

[beerisgood]

@Zanthed
Any information why the stealth mode instead of normal activated firewall mode should be used?

[ghost]

It ignores incoming traffic instead of rejecting it along with ignoring ICMP. Useful if someone on the network is trying to port scan.

[ghost]

Not really. You should assume the network you're on is hostile and never trust it like on Windows 11. Block incoming connections + stealth mode fully distrusts the network.

[beerisgood]

Alright. Thanks!

[ghost]

Stealth mode does more but I haven't looked into it too much beyond a few forum posts and Apple documentation which just in general say "silent ignores packets instead of rejects/denies" which includes ICMP.

[beerisgood]

Okay

[beerisgood]

@Zanthed I found that:

When stealth mode is enabled, the Mac will not respond to any probing requests, and only requests
from authorized applications will still be authorized.

Enabling firewall stealth mode may prevent certain remote mechanisms used for maintenance and compliance scanning from properly functioning. Information System Security Officers (ISSOs) are advised to first fully weigh the potential risks posed to their organization before opting not to enable stealth mode.

Source:
macOS 12
Security Configuration - NIST 800-171 Rev 2
Monterey Guidance, Revision 2 (2022-03-16)