[KB3275] Create a firewall rule to allow/disallow use of a certain application in ESET Cyber Security for macOS

Issue

Details

Firewall controls all network traffic to and from the system by allowing or blocking individual network connections based on specified filtering rules. It protects against attacks from remote computers and allows you to block specific services.

Solution

Review the basics of Firewall rules and application rules

Firewall rules

Firewall recognizes three types of network connections:

  • Outbound connections
  • Inbound connections
  • Trusted inbound connections - inbound connections originating from a trusted network

When a rule matches the current communication, that rule is applied, and no further rules are processed for that connection.

  1. From the macOS menu bar, click ESET Cyber SecuritySettings...

  2. In the Settings window, click Firewall under Protections.

Figure 1-1
  1. Firewall processes rules in order from the top of the rule stack, which is shown in the Firewall preferences.

    • Global rules are applied first if allowed.
    • Application rules are next if defined. When an application rule exists, it matches the application path, and its conditions are applied to the application’s communication.
    • Fallback rules are processed last.

      Figure 1-2
  1. By default, Firewall enables outbound connections, and inbound connections are allowed specifically for Apple applications. Click Fallback Rules to modify the settings.

    Application signatures

    A valid Apple code signature signs an Apple application, and a trusted third-party application is signed by a valid Certificate Authority.

    Figure 1-3
Application rules

Application rules are based on the application's path, and settings for both inbound and outbound communication for that application are specified.

You can define application rules from the context menu in the Applications table under the Tools section of the main interface.

Figure 1-4
 

Create a firewall rule to block or allow incoming or outgoing internet communications for an application in ESET Cyber Security

  1. From the macOS menu bar, click ESET Cyber SecuritySettings...

  2. In the Settings window, click Firewall under Protections.

Figure 2-1
  1. Click Application Rules.

    Figure 2-2
  2. Click the + (plus) icon to add an application rule.

    Figure 2-3
  3. Select an application from the Applications menu and click Open.

    Figure 2-4
  4. Select a filtering option for the inbound and outbound settings, and click OK to save the rule.

    Figure 2-5
  5. To remove the rule, select the rule from the Application Rules list, click the - (minus) icon, and click OK.

    Figure 2-6

Troubleshooting

My third-party application is not working

Suppose a non-Apple application stops working after enabling the Firewall. In that case, it’s likely because the application requires inbound connections initiated from the server side, which the Firewall blocks by default for non-Apple applications.

Solution:
Enable all inbound communications. If the communication starts working, proceed by creating a Firewall rule.

An issue is occurring due to the home Firewall

A universal solution isn’t possible for every issue a user might encounter, as each solution depends on the specific home Firewall setup. However, to resolve connectivity issues, you can use Firewall logs to identify and resolve the problems:

  1. Enable logging for blocked connections.

  2. Replicate the issue.

  3. Open the Firewall Logs under the Logs subsection of the Tools section in the main interface.

  4. Identify the blocked communications. For easier analysis, export Firewall logs as a CSV file, then import them into a spreadsheet program like MS Excel to search for the issue.

  5. Create the necessary rule in the Firewall to allow the identified communication.