Thank you for your review
Email me when discounted: 
WaterRoof is a ipfw firewall management frontend with bandwidth tuning, NAT setup, port redirection, dynamic rules tracking, live connections blocks, predefined rule sets, wizard, logs, graphic report and statistics and other features.
  • uses Mac OS X built-in IPFW firewall. No kernel modules, no extensions, no pain. WaterRoof is free and open-source
  • the most advanced Mac OS X free graphic frontend for ipfw now features a new, clean interface. WaterRoof lets you create, modify, delete, move ipfw ipv4 and ipv6 rules very quickly.
  • designed for Mac OS X and Mac OS X Server
  • build ipfw rules more...

What's New

Version 3.8:
  • full OS X 10.8 support
  • interface with bigger fonts
  • improved network interfaces list
  • fixed logs statistics for OS X 10.8


OS X 10.5.8 or later

Similar Software

Open Comparison
Suggest Other Similar Software
Leave a Review

WaterRoof User Discussion

Nobody has reviewed or commented on this app yet. Add your own comment and get a discussion going!
Sort by: Time | Smiles
JCH2 Member IconComment+392

The downfall here is misunderstanding of daemons. Without a live daemon running, there's no in the moment warnings and options to cut off a program seeking to establishing and incoming or outgoing connection illicitly. This might useful for analyzing and setting up a default firewall configuration with greater control than the dumbed down swiss cheese setup that comes default in OS X. But without the assistance of a daemon, even running into a java applet on a web page won't always trigger a warning to do something about it.

No, doesn't hold a candle to any form of live defense, such as in Little Snitch.

Reply4 replies
Version 3.7

Little Snitch is for outgoing connections only...

Hanynet.com (Developer)

"There's no in the moment warnings and options to cut off a program seeking to establishing and incoming or outgoing connection illicitly".
False. Anyway this is not the purpose of IPFW, which is the network firewall that Apple included in Mac OS X since 2001. And it is not the purpose of WaterRoof, even if WaterRoof adds to OSX an easy way to monitor IPFW logs in real time. This is a way to get notified about wanted/unwanted connections using IPFW, but you should use it only to debug IPFW rulesets and not for your every day use. Checking for "program seeking to establishing connections" is exactly the purpose of application firewalls, not network firewalls.

Since OSX 10.5 there's NO way to configure IPFW with the OSX GUI. The OSX firewall preferences panes are about ALF, the application layer firewall, while IPFW is a network firewall. WaterRoof is a frontend for IPFW.

You simply can't compare a network firewall (IPFW) and an application firewall (LittleSnitch or ALF). They do completely different things. All network firewalls work like IPFW. And all application firewalls work like LittleSnitch.
If you need "live defense" then you should use an application firewall. Anyway you should read documentation about network firewalls and application firewalls and understand how they work before making any choice. Adding a "daemon" to WaterRoof has absolutely no sense. IPFW has been deprecated in OSX 10.7 so it will soon disappear from OSX. The new default network firewall for OSX is PF. PF is different from IPFW but it works the same way as IPFW. There are rules (static or dynamic) and logs. There's no "daemon". :-)


@Libertyforall1776 Little Snitch now has incoming firewall, but is still lacking the ability to bock IP addressees.


Hanynet: You bring up some useful points here that have to be acknowledged... which I didn't. Good information worth sharing, though it still doesn't change my view on the app.

But thanks just same for the explanation, as it was much more useful that the petty little smiley wars that too often occur here at Mac Update.

goldenthal.g Member IconComment+1

Declining vision requires scalability wrt this otherwise very interesting-looking program (and only one other so far). The "zoom" merely takes up more screen real estate, does not enlarge fonts too, so no improvement. I know I can change the resolution settings of my monitor, but that is a nuisance for, so far, only Water Roof and Pure Music.

Reply1 reply
Version 3.6

Will you compare the cost of PureMusic to that of WaterRoof?

Daniel Albaugh Member IconComment+1
Daniel Albaugh

When I click "Generate graphic report' , I get the error

The file /Applications/WaterRoof.app/Contents/Resources/fwanalog/out/alldates.html does not exist. (1)

Sure enough, you can only get as far as /Applicatons/WaterRoof.app/Contents/Resources/fwanalog. Hany, can this be fixed?

Reply1 reply
Version 3.3
Hanynet.com (Developer)

This error occurs when log file is empty or when it contains only logs from application level firewall and not ipfw. To generate a graphic report you need /var/log/appfirewall.log to be populated with ipfw logs. Please check the contextual help button in waterroof logs window.
Graphic report is saved in /Applications/WaterRoof.app/Contents/Resources/fwanalog/out/ and can be optionally exported to desktop. To make a simple test do the following:
flush rules, add one rule:
1000 deny log ip from any 80 to me
enable firewall logging, open safari and try to browse 3-4 web sites; they should not load; flush your rules and check logs, then generate a graphic report.

Ericob Member IconComment+41

Creating names for new, specialized, software products is difficult. I have to say that "Water" + "Roof" is a pretty clever twist on "Fire" + "Wall." And this from someone who does not use English as their primary language! Pretty good... :)

Reply0 replies
Version 3.0
Aikousha Member IconComment+256

Definitely doesn't work for me. Won't save rules, locks up with scripting errors after 4th block attempt, after crash (about 5 minutes after lockup), will not restart (icon appears in dock but nothing else happens, and this then creates a situation where a power-button restart is required).
This is off a clean install of 10.4.11, so I can't understand what is going wrong.

Reply1 reply
Version 2.1
Anonymous Member Icon

Those issues must be related with your "clean install of 10.4.11". WaterRoof has been tested and reported to work on both Mac OS X 10.4 and 10.5. If you need help please contact me and I'll try to understand why you are experiencing such problems. There are minor bugs in latest version but you are the first user since 2 years reporting those strange behaviours.

nicolasd Member IconComment+120

thank goodness this is a free app! thanks so much to the developer for the effort! it is appreciated more than you know.

Reply2 replies
Version 2.0

There is a PayPal button for donations at the developer's website if you feel inclined to donate.

Hanynet.com (Developer)

Thank you nicolasd, I think we are part of a great community made of great people.
Security is a issue for everyone, and I think that security tools must be free and open-source. This is the only way to achieve the best results.
I would like to say thanks to every friend that helped me with code and beta testing.
I don't consider WaterRoof and NoobProof as 'my effort' but as 'community needs satisfied by community members.'
My english is very bad, anyway I hope you understand my words.
Regards from Italy


Hanynet.com (Developer) Member IconDev+38
Hanynet.com (Developer)

Now up and running, sorry about that.

Reply0 replies
Version 1.9
xypher Member IconComment+54

Just released and the link is down?

Reply2 replies
Version 1.9

So it seems. I was able to download the file at the time it was posted today, now no can do.


The developer would like you and everyone else to know that the problem has been rectified and the file is now available again.

variac Member IconComment+0

Is it possible to have a waterRoof version that will run on MAC OS 10.3

Reply1 reply
Version 1.8
Hanynet.com (Developer)

I'm sorry but Mac OS X 10.3 features ipfw version 1 which lacks many options compared to ipfw version 2 found in Tiger. Mac OS X 10.3 is old and the applescript subsystem is not as stable as for Mac OS X 10.4. And anyway it is not suitable for WaterRoof.
For these reasons the minumum requirements for WaterRoof is Mac OS X 10.4.

Likos Member IconComment+26

Thanks for a useful tool. If time permits can you please consider adding port knocking to the list of features?

Reply0 replies
Version 1.8
user icon+47
Version 3.8
user icon+9
Version 3.5
user icon+7
Version 3.2
> 5 7


Current Version (3.x)


Downloads 47,372
Version Downloads 7,990
License Free
Date 18 Dec 2012
Platform OS X / PPC 32 / Intel 32
Price Free
Learn how MacUpdate Desktop makes installing apps from MacUpdate.com one-click easy.
Next time, install WaterRoof with 1-click

Learn how MacUpdate Desktop can install apps on MacUpdate with the simple click of the Install apps with MacUpdate Desktop icon. Plus, keep all your apps updated. Play video...