Flying Buttress - 1.4

it changes every login password!!

This was my favorite firewall app. Sadly, the developer seems to have stopped almost all support without giving any reason why. What's worse, he shut down the forum for this and his other apps without any explanation, taking it offline and making all the community input unavailable.

This wouldn't be all that problematic if this app just worked - but it doesn't, especially under Tiger. (See two comments below.)

There have been various reports of problems getting Brickhouse to startup properly in 10.3.9 or later, and the reason for that is twofold, (1) the boot script doesn't write any messages to the console letting you know whether it's starting or not, leading to confusion, and (2) the parameters file doesn't list the proper required services needed to be running before starting the script, causing it to start too early and consequently, the settings get wiped out when the system firewall extension gets loaded. Brickhouse needs to load after the IP Firewall extension loads, not before.

To solve this, your boot script needs to look like this (/Library/StartupItems/Firewall/Firewall):

#!/bin/sh
# Firewall Boot Script
# Generated by BrickHouse

. /etc/rc.common

#===========================================================
# Activate Firewall Filters
#===========================================================

ConsoleMessage "Activating Brickhouse Filters"

/sbin/ipfw -q /etc/firewall.conf

#===========================================================
# Enable IP Firewall Logging
#===========================================================

ConsoleMessage "Enabling Brickhouse Logging"

/usr/sbin/sysctl -w net.inet.ip.fw.verbose=1
/usr/sbin/sysctl -w net.inet.ip.fw.verbose_limit=65535

And your startup parameters file needs to look like this (/Library/StartupItems/Firewall/StartupParameters.plist):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Description</key>
<string>BrickHouse Firewall</string>
<key>Messages</key>
<dict>
<key>start</key>
<string>Activating Firewall</string>
<key>stop</key>
<string>Clearing Firewall</string>
</dict>
<key>OrderPreference</key>
<string>Late</string>
<key>Provides</key>
<array>
<string>Firewall</string>
</array>
<key>Requires</key>
<array>
<string>NetworkExtensions</string>
<string>Resolver</string>
<string>Super Server</string>
</array>
</dict>
</plist>

For the record, the Messages key in the parameters file has been deprecated by Apple and doesn't do anything, which is why normally you can't even tell if the rules have been applied. The addition of the ConsoleMessage commands in the actual script remedies that.

After making the changes and rebooting, you should now be able to look at the system.log and see if Brickhouse has loaded properly.

While Brickhouse is a great product, it's plain sloppy of the developer not to have corrected this by now.

From what I've found, BrickHouse is the best GUI application for accessing the built-in firewall ipfw. As such it is good for people who want more features than the simple preference pane, but don't want to work in the CLI. It is now up to 1.3 and has come far, but it still needs work to warrant a full five star recommendation and the requested cost. (I paid anyway.) Some problems that still exist are:

0. The author is unresponsive to emailed queries after two weeks.

1. When creating rules (filters), you cannot simultaneously create a rule to apply to both built-in Ethernet (en0) and wireless Ethernet (en1). The interface forces you to create a rule for one interface, then for the other. If you have a handcrafted custom ruleset that takes time to build, this will double your time. There should be an option in the GUI to apply rules to both (all) interfaces.

2. No matter the order in which you create custom rules, BrickHouse enters them in random order. You can drag and drop them into your preferred order, but this is extremely tedious and time consuming. An option to reorder the rules by port number (a standard method for configuring rules in the CLI) would be a big time saver instead of the current big time waster.

3. Editing rules by hand (either in the CLI or in BBEdit) and then reviewing them in BrickHouse causes the app to crash.

4. No longer works in 10.2.

5. Payment of the shareware fee does not seem to prompt any reply to queries about problems or suggestions for improvement.

Version 1.3 kills my internet connection. Version 1.1b6 works fine. I have ADSL/VPN with a Alcatel Speed Touch Home and use DigiTunnel to connect.