Difference between revisions of "Configure Firewall"

From AwkwardTV
Jump to: navigation, search
m
m (Enabling the Firewall without an Intel Mac)
 
(20 intermediate revisions by 8 users not shown)
Line 1: Line 1:
[http://magickmushroom.ifrance.com/text/sfondo-cagnolino/ sfondo cagnolino] [http://ericaroo.ifrance.com/bimbi-che.htm bimbi che nascono] [http://nightshadekiu.ifrance.com/blog/quotazioni-volvo.htm quotazioni volvo] [http://chooit.ifrance.com/small/pc-.htm pc2100 1 gb] [http://magickmushroom.ifrance.com/text/super-bravo/ super bravo brondi] [http://magickmushroom.ifrance.com/text/claudia-presecan/ claudia presecan] [http://nightshadekiu.ifrance.com/blog/sardegna-vacanza.htm sardegna vacanza affitto] [http://ericaroo.ifrance.com/pigro-midi.htm pigro midi pino daniele] [http://aussiejesus.ifrance.com/library/video-onde.htm video onde alex baroni] [http://aussiejesus.ifrance.com/library/happy-christmas.htm happy christmas spartito] [http://reptilianlace.ifrance.com/view/olimpus-mju/ olimpus mju mini] [http://reptilianlace.ifrance.com/view/varese-coppie/ varese coppie] [http://geographi.ifrance.com/new/il-diavolo.htm il diavolo bianco] [http://themelegant.ifrance.com/library/zahira.htm zahira] [http://lindenss.ifrance.com/articles/lases/ lases] [http://crytomorrow.ifrance.com/small/costumi-cavalli/ costumi cavalli] [http://chooit.ifrance.com/small/calzatura-bambini.htm calzatura bambini] [http://nightshadekiu.ifrance.com/blog/sony-kv.htm sony kv 32fq70e] [http://chooit.ifrance.com/small/video-canalis.htm video canalis] [http://vla5.ifrance.com/data/vasca-idromassaggio/ vasca idromassaggio esterni] [http://reptilianlace.ifrance.com/view/david-guetta/ david guetta stay] [http://geographi.ifrance.com/new/codice-magnum.htm codice magnum] [http://chooit.ifrance.com/small/mr-snoozle.htm mr snoozle] [http://ericaroo.ifrance.com/disegni-sposi.htm disegni sposi] [http://aussiejesus.ifrance.com/library/modulo-wanted.htm modulo wanted] [http://darphbobo.ifrance.com/styles/hit-mania/ hit mania dance 95] [http://mikatoner.ifrance.com/www-rc.htm www rc tampico com] [http://crytomorrow.ifrance.com/small/matchbook/ matchbook] [http://themelegant.ifrance.com/library/mercury-gioco.htm mercury gioco psp] [http://harukamin.ifrance.com/top-one/ top one] [http://darphbobo.ifrance.com/styles/racconti-erotici/ racconti erotici mia moglie] [http://pensfromhotels.ifrance.com/articles/subaru-legacy/ subaru legacy] [http://reptilianlace.ifrance.com/view/cestelli-lavastoviglie/ cestelli lavastoviglie] [http://chooit.ifrance.com/small/pagine-bianche.htm pagine bianche padova] [http://pensfromhotels.ifrance.com/articles/ati-se/ ati 9200se] [http://reptilianlace.ifrance.com/view/borsa-a/ borsa a tracolla uomo] [http://ericaroo.ifrance.com/comandante-cheguevara.htm comandante cheguevara] [http://reptilianlace.ifrance.com/view/enola-gay/ enola gay] [http://chooit.ifrance.com/small/cisco-.htm cisco  350 series pc card] [http://nightshadekiu.ifrance.com/blog/canopy.htm canopy] [http://geographi.ifrance.com/new/cassa-depositi.htm cassa depositi prestito] [http://nightshadekiu.ifrance.com/blog/finanziaria-.htm finanziaria 2004 adeguamento statuto soc] [http://pensfromhotels.ifrance.com/articles/import-conchiglie/ import conchiglie] [http://harukamin.ifrance.com/www-donne/ www donne italiane it] [http://magickmushroom.ifrance.com/text/noi-figli/ noi figli dei magi] [http://pnkrosesnpearls.ifrance.com/data/mature-esibizioniste.htm mature esibizioniste] [http://aussiejesus.ifrance.com/library/pino-dangio.htm pino dangio] [http://darphbobo.ifrance.com/styles/marcy-gray/ marcy gray] [http://lindenss.ifrance.com/articles/alberi-/ alberi  e  scoiattoli] [http://aussiejesus.ifrance.com/library/spedizioni-trasporti.htm spedizioni trasporti] [http://ericaroo.ifrance.com/this-love.htm this love is] [http://nightshadekiu.ifrance.com/blog/www-ecuador.htm www ecuador media com] [http://aussiejesus.ifrance.com/library/s-r.htm s3 r kyocera] [http://aieeeeeeee.ifrance.com/directory/turbamento/ turbamento] [http://lindenss.ifrance.com/articles/povera-sora/ povera sora] [http://pnkrosesnpearls.ifrance.com/data/ispettore-derrick.htm ispettore derrick] [http://nightshadekiu.ifrance.com/blog/testo-vasco.htm testo vasco rossi] [http://geographi.ifrance.com/new/bici-elettrica.htm bici elettrica alluminio] [http://mikatoner.ifrance.com/les-biches.htm les biches n 2] [http://chooit.ifrance.com/small/ristorazione-e.htm ristorazione e catering] [http://aieeeeeeee.ifrance.com/directory/roadmate/ roadmate 700] [http://darphbobo.ifrance.com/styles/occhiali/ occhiali] [http://harukamin.ifrance.com/stampo-per/ stampo per ravioli] [http://magickmushroom.ifrance.com/text/tradurre-latino/ tradurre latino] [http://lindenss.ifrance.com/articles/optio-wr/ optio 33wr pentax] [http://geographi.ifrance.com/new/www-sabrinaghio.htm www sabrinaghio it] [http://darphbobo.ifrance.com/styles/philips-sbchn/ philips sbchn110] [http://themelegant.ifrance.com/library/ormoc.htm ormoc] [http://pensfromhotels.ifrance.com/articles/nordrheinwestfalen/ nordrheinwestfalen] [http://pnkrosesnpearls.ifrance.com/data/bedhi-com.htm bedhi com] [http://allynda.ifrance.com/cruz-juan/ cruz juan de la] [http://aussiejesus.ifrance.com/library/backstreet-boys.htm backstreet boys video] [http://reptilianlace.ifrance.com/view/www-auxologia/ www auxologia it] [http://harukamin.ifrance.com/condizionatore-fisso/ condizionatore fisso] [http://magickmushroom.ifrance.com/text/piattola/ piattola] [http://pensfromhotels.ifrance.com/articles/hp-laserjet/ hp laserjet 8000] [http://magickmushroom.ifrance.com/text/lx-t/ lx t7206 011] [http://darphbobo.ifrance.com/styles/natanz/ natanz] [http://allynda.ifrance.com/canon-eos/ canon eos 300d tele] [http://mikatoner.ifrance.com/ewqewq.htm ewqewq] [http://lindenss.ifrance.com/articles/onore-in/ onore in cinese] [http://nightshadekiu.ifrance.com/blog/freemovie-porno.htm freemovie porno animal] [http://crytomorrow.ifrance.com/small/new-entry/ new entry] [http://chooit.ifrance.com/small/spartiti-musicali.htm spartiti musicali free] [http://themelegant.ifrance.com/library/camera-riccione.htm camera riccione] [http://lindenss.ifrance.com/articles/cerca-via/ cerca via] [http://pnkrosesnpearls.ifrance.com/data/ingegner-antonio.htm ingegner antonio tini] [http://crytomorrow.ifrance.com/small/novastorm/ novastorm] [http://vla5.ifrance.com/data/renault/ renault 4] [http://allynda.ifrance.com/bicicletta-chopper/ bicicletta chopper] [http://allynda.ifrance.com/sabarkantha/ sabarkantha] [http://magickmushroom.ifrance.com/text/www-lascuola/ www lascuola it] [http://nightshadekiu.ifrance.com/blog/abi-titmuss.htm abi titmuss vid] [http://pnkrosesnpearls.ifrance.com/data/ticketmaster.htm ticketmaster] [http://darphbobo.ifrance.com/styles/loghi-e/ loghi e suonerie tree] [http://geographi.ifrance.com/new/ufficio-acqui.htm ufficio acqui terme] [http://chooit.ifrance.com/small/condizionatori-delonghi.htm condizionatori delonghi fisso] [http://aieeeeeeee.ifrance.com/directory/polikuska/ polikuska] [http://nightshadekiu.ifrance.com/blog/network-per.htm network per ps2] [http://aieeeeeeee.ifrance.com/directory/mistic-india/ mistic india] [http://harukamin.ifrance.com/orologi-meccanici/ orologi meccanici] [http://pensfromhotels.ifrance.com/articles/torre-le/ torre le nocelle] [http://geographi.ifrance.com/new/integratori-vitamina.htm integratori vitamina b] [http://darphbobo.ifrance.com/styles/carey-without/ carey without you] [http://lindenss.ifrance.com/articles/pelvoux-gruppo/ pelvoux gruppo del] [http://chooit.ifrance.com/small/higher-education.htm higher education] [http://pnkrosesnpearls.ifrance.com/data/elevation.htm elevation] [http://reptilianlace.ifrance.com/view/ministero-dell/ ministero dell istruzione dell universit] [http://allynda.ifrance.com/philips-hq/ philips hq 8894] [http://aieeeeeeee.ifrance.com/directory/zigo/ zigo] [http://lindenss.ifrance.com/articles/canon-mvx/ canon mvx 350i] [http://aussiejesus.ifrance.com/library/http-jeegar.htm http jeegar com] [http://aieeeeeeee.ifrance.com/directory/tatuaggio-delfino/ tatuaggio delfino] [http://aieeeeeeee.ifrance.com/directory/giocattoli-in/ giocattoli in legno bimbi] [http://vla5.ifrance.com/data/max-speziali/ max speziali] [http://themelegant.ifrance.com/library/programma-traduzione.htm programma traduzione] [http://ericaroo.ifrance.com/router-netgear.htm router netgear dg834git] [http://crytomorrow.ifrance.com/small/la-vedova/ la vedova nera] [http://lindenss.ifrance.com/articles/ingranaggi-plastica/ ingranaggi plastica] [http://aieeeeeeee.ifrance.com/directory/emulador-game/ emulador game boy] [http://feelosof.ifrance.com/description/torchon-personnalise/ torchon personnalise] [http://shmarodral.ifrance.com/text/etrade.htm etrade] [http://feelosof.ifrance.com/description/la-rivolta/ la rivolta dei gladiatori] [http://chrystiala.ifrance.com/library/moroon.htm moroon 5] [http://shotlandetz.ifrance.com/blog/gli-scettici/ gli scettici] [http://firejedi.ifrance.com/new/psp-jap/ psp jap 1 50] [http://chrystiala.ifrance.com/library/paratipo.htm paratipo] [http://emrinalexander.ifrance.com/styles/cherokee-.htm cherokee 2 5 td sport] [http://infunt.ifrance.com/articles/mario-e/ mario e yoshi] [http://seachildelf.ifrance.com/resources/cirrus/ cirrus] [http://shmarodral.ifrance.com/text/sigma.htm sigma 28 105] [http://listsobacka.ifrance.com/small/iee.htm iee] [http://cikumuffin.ifrance.com/topic/mat-s/ mat s rock the drum] [http://eccoblackfin.ifrance.com/html/hentai-movi.htm hentai movi] [http://makkiesan.ifrance.com/piera.htm piera] [http://ohmygoshalix.ifrance.com/blog/season.htm season] [http://ohmygoshalix.ifrance.com/blog/incontro-pienza.htm incontro pienza] [http://lethalga.ifrance.com/topic/tal-vez/ tal vez de jerry rivera] [http://ohmygoshalix.ifrance.com/blog/duo-matrix.htm duo matrix jane] [http://cikumuffin.ifrance.com/topic/lumix-dmcfx/ lumix dmcfx7] [http://shotlandetz.ifrance.com/blog/pina-menichelli/ pina menichelli] [http://firejedi.ifrance.com/new/gazetta-de/ gazetta de sud] [http://feelosof.ifrance.com/description/asus-kvx/ asus k8vx] [http://seachildelf.ifrance.com/resources/asus-anx/ asus a7n8x  x] [http://thecakeblog.ifrance.com/articles/masterizzatore-cd/ masterizzatore cd dvd esterno] [http://ohmygoshalix.ifrance.com/blog/eamon-fuck.htm eamon fuck it i don t want you b] [http://jene7777777.ifrance.com/new/autocad-lt.htm autocad lt 2004 italiano] [http://makkiesan.ifrance.com/paramount.htm paramount] [http://jazzyjoe.ifrance.com/zelda-ocarina/ zelda ocarina of time] [http://beatpoetsa.ifrance.com/description/diana-queen.htm diana queen] [http://seachildelf.ifrance.com/resources/victorgsm-softw/ victorgsm softw] [http://jazzyjoe.ifrance.com/eletti-in/ eletti in europa] [http://cikumuffin.ifrance.com/topic/thomson-micro/ thomson micro hifi] [http://thecakeblog.ifrance.com/articles/sogno-erotico/ sogno erotico con serena autieri] [http://listsobacka.ifrance.com/small/dance-award.htm dance award] [http://shotlandetz.ifrance.com/blog/pc-acer/ pc acer] [http://infunt.ifrance.com/articles/el-embraje/ el embraje] [http://jazzyjoe.ifrance.com/aspazija/ aspazija] [http://cikumuffin.ifrance.com/topic/misstres/ misstres] [http://seachildelf.ifrance.com/resources/www-gigid/ www gigid alessio it] [http://listsobacka.ifrance.com/small/flash-.htm flash 2 advance] [http://lethalga.ifrance.com/topic/voce-e/ voce e demais] [http://firejedi.ifrance.com/new/video-musique/ video musique o zone] [http://jazzyjoe.ifrance.com/ancora-una/ ancora una data non ufficiale per la psp] [http://jene7777777.ifrance.com/new/channel-tv.htm channel tv] [http://chrystiala.ifrance.com/library/dvd-region.htm dvd region free] [http://emrinalexander.ifrance.com/styles/logitech-mx.htm logitech mx510 optical mouse] [http://lethalga.ifrance.com/topic/battista-mantovano/ battista mantovano] [http://eccoblackfin.ifrance.com/html/tim-burton.htm tim burton] [http://pouringsunny.ifrance.com/description/intel-/ intel 64 bit] [http://shotlandetz.ifrance.com/blog/www-sicuro/ www 6sicuro it] [http://jojorock.ifrance.com/articles/stufa-condizionatore/ stufa condizionatore arredamento climatizzatore] [http://pouringsunny.ifrance.com/description/microchip/ microchip] [http://thecakeblog.ifrance.com/articles/lego-loco/ lego loco] [http://jene7777777.ifrance.com/new/redondo-de.htm redondo de ricota] [http://eccoblackfin.ifrance.com/html/tone-mai.htm tone mai] [http://belikan.ifrance.com/library/barebone-vendita.htm barebone vendita] [http://cikumuffin.ifrance.com/topic/sexy-single/ sexy single] [http://liubash.ifrance.com/new/capodanno-.htm capodanno 2004 dove costa poco] [http://emrinalexander.ifrance.com/styles/casse-lem.htm casse lem attive] [http://animaetrix00.ifrance.com/content/hp-c/ hp 959c] [http://firejedi.ifrance.com/new/allison-nuoro/ allison nuoro] [http://firejedi.ifrance.com/new/elfi-oscuri/ elfi oscuri] [http://jene7777777.ifrance.com/new/nc.htm nc6120 730] [http://cikumuffin.ifrance.com/topic/herida/ herida] [http://liubash.ifrance.com/new/foto-lavinia.htm foto lavinia borromeo] [http://liubash.ifrance.com/new/video-scopata.htm video scopata gratis] [http://lethalga.ifrance.com/topic/sud-sicilia/ sud sicilia] [http://cikumuffin.ifrance.com/topic/viajes-a/ viajes a la luna] [http://thecakeblog.ifrance.com/articles/scart-vga/ scart vga] [http://beatpoetsa.ifrance.com/description/gps-globalsat.htm gps globalsat bt338] [http://chrystiala.ifrance.com/library/esecuzione-ostaggi.htm esecuzione ostaggi video] [http://infunt.ifrance.com/articles/argo-pompa/ argo pompa calore] [http://emrinalexander.ifrance.com/styles/i-cari.htm i cari parenti] [http://jene7777777.ifrance.com/new/flash-canon.htm flash canon ste2] [http://pouringsunny.ifrance.com/description/lavoro-partime/ lavoro partime in campania] [http://cikumuffin.ifrance.com/topic/ragazze-palermitane/ ragazze palermitane] [http://feelosof.ifrance.com/description/p/ p003] [http://infunt.ifrance.com/articles/corpo-foresta/ corpo foresta] [http://belikan.ifrance.com/library/jvc-pdb.htm jvc pd42b50] [http://thecakeblog.ifrance.com/articles/western-digital/ western digital 10000] [http://chrystiala.ifrance.com/library/sat-link.htm sat link] [http://thecakeblog.ifrance.com/articles/maledetto/ maledetto] [http://listsobacka.ifrance.com/small/recovery-genius.htm recovery genius 6 0] [http://shotlandetz.ifrance.com/blog/globus-slimmy/ globus slimmy] [http://shotlandetz.ifrance.com/blog/radeon-xpress/ radeon xpress] [http://emrinalexander.ifrance.com/styles/vola-colomba.htm vola colomba] [http://eccoblackfin.ifrance.com/html/ngs-vip.htm ngs vip mouse] [http://shotlandetz.ifrance.com/blog/software-fax/ software fax gratis] [http://pouringsunny.ifrance.com/description/obiettivi-canon/ obiettivi canon 28135] [http://thecakeblog.ifrance.com/articles/calligaris/ calligaris] [http://makkiesan.ifrance.com/palm-lifedrive.htm palm lifedrive bt con tomtom gps] [http://lethalga.ifrance.com/topic/volavola/ volavola] [http://shotlandetz.ifrance.com/blog/i-time/ i time of my life] [http://firejedi.ifrance.com/new/donatella-donatella/ donatella donatella rettore] [http://infunt.ifrance.com/articles/subway/ subway] [http://cikumuffin.ifrance.com/topic/elthon-john/ elthon john] [http://jojorock.ifrance.com/articles/guanti-seta/ guanti seta] [http://firejedi.ifrance.com/new/hd-firewire/ hd firewire lacie] [http://infunt.ifrance.com/articles/lg-lettori/ lg lettori divx] [http://jojorock.ifrance.com/articles/moka-elettrica/ moka elettrica] [http://liubash.ifrance.com/new/transsex.htm transsex] [http://listsobacka.ifrance.com/small/mike-buongiorno.htm mike buongiorno] [http://jojorock.ifrance.com/articles/il-vecchio/ il vecchio e mare] [http://lethalga.ifrance.com/topic/camicie-bordeaux/ camicie bordeaux] [http://shmarodral.ifrance.com/text/groland.htm groland] [http://eccoblackfin.ifrance.com/html/venda-stato.htm venda (stato)] [http://cikumuffin.ifrance.com/topic/michael-moriarty/ michael moriarty] [http://makkiesan.ifrance.com/xl.htm xl] [http://liubash.ifrance.com/new/scarpe-donna.htm scarpe donna 37] [http://eccoblackfin.ifrance.com/html/presa-scart.htm presa scart] [http://eccoblackfin.ifrance.com/html/cyprees-hill.htm cyprees hill] [http://cikumuffin.ifrance.com/topic/lil-supporto/ lil supporto informatico in ospedale] [http://jazzyjoe.ifrance.com/tv-color/ tv color al plasma 42 memory stick] [http://pouringsunny.ifrance.com/description/unimol/ unimol] [http://shmarodral.ifrance.com/text/www-es.htm www es] [http://firejedi.ifrance.com/new/motorola-cellulare/ motorola cellulare v51] [http://jene7777777.ifrance.com/new/primo-piatto.htm primo piatto ricetta] [http://feelosof.ifrance.com/description/f-f/ f f f folling] [http://listsobacka.ifrance.com/small/lavoro-hannover.htm lavoro hannover] == Note ==
+
== Note ==
 
'''The AppleTV seems to ship with no firewall rules configured.'''
 
'''The AppleTV seems to ship with no firewall rules configured.'''
 
'''There is no need to hack up a way to disable the firewall.'''
 
'''There is no need to hack up a way to disable the firewall.'''
  
  
In MacOS X, at boot time, <pre>/usr/libexec/FirewallTool</pre> runs, which reads the file <pr
+
In MacOS X, at boot time, <pre>/usr/libexec/FirewallTool</pre> runs, which reads the file <pre>/Library/Preferences/com.apple.sharing.firewall.plist</pre>
5A8
 
e>/Library/Preferences/com.apple.sharing.firewall.plist</pre>
 
  
 
Neither the binary nor the plist are distributed with the AppleTV OS, and it is therefore not surprising that in a default OS install, the ipfw kext has a single 'allow any' default rule:
 
Neither the binary nor the plist are distributed with the AppleTV OS, and it is therefore not surprising that in a default OS install, the ipfw kext has a single 'allow any' default rule:
Line 14: Line 12:
 
65535 allow ip from any to any
 
65535 allow ip from any to any
 
</pre>
 
</pre>
 
 
  
 
== Enabling the Firewall ==
 
== Enabling the Firewall ==
Line 23: Line 19:
 
* Copy one you like from an Intel Mac
 
* Copy one you like from an Intel Mac
 
* Copy one, then edit as you like with the Property List Editor that comes with Xcode. (see: [http://www.macosxhints.com/article.php?story=20060427124349687 MacOS Hints article])
 
* Copy one, then edit as you like with the Property List Editor that comes with Xcode. (see: [http://www.macosxhints.com/article.php?story=20060427124349687 MacOS Hints article])
* [http://wiki.awkwardtv.org/wiki/Install_System_Preferences Install System Preferences] from an Intel Mac and configure as usual.
+
* [[Install System Preferences]] from an Intel Mac and configure as usual.
 +
 
 +
== Enabling the Firewall without an Intel Mac ==
 +
 
 +
It's possible to set up the firewall without using any GUI, and this appears to work (tested on a v2.1 AppleTV) without copying the plist or any other files from an Intel Mac.  '''Be warned''' - using this method it's quite likely that your machine will be un-firewalled for a short time during boot-up, before the firewall rules script takes effect.
 +
 
 +
Create the following file as firewall_config.sh in /Users/frontrow.  It can serve as a base set of firewall rules to get you started - if you want more google for "ipfw".  Don't forget you must change the IP address under the comment 'Allow anything from LAN' depending on your own LAN's ip address range.
 +
#!/bin/sh
 +
sudo ipfw -f flush
 +
#sudo ipfw -f list
 +
 +
#exclude loopback traffic
 +
sudo ipfw add 00003 allow all from any to any via lo0
 +
 +
#Deny any spoofed loopback/multicast traffic
 +
sudo ipfw add 02010 deny log ip from 127.0.0.0/8 to any in
 +
sudo ipfw add 02020 deny log ip from any to 127.0.0.0/8 in
 +
sudo ipfw add 2030 deny log ip from 224.0.0.0/3 to any in
 +
sudo ipfw add 2040 deny log tcp from any to 224.0.0.0/3 in
 +
 +
#Allow outgoing/established
 +
sudo ipfw add 02050 allow tcp from any to any out
 +
sudo ipfw add 02060 allow tcp from any to any established
 +
 +
#Allow anything from LAN
 +
sudo ipfw add 02070 allow ip from 192.168.0.0/24 to any
 +
 +
#Block everything else
 +
sudo ipfw add 12190 deny log tcp from any to any
 +
sudo ipfw add 65535 allow ip from any to any
 +
 
 +
Make sure this script is executable
 +
chmod 755 firewall_config.sh
 +
 
 +
Add the following to the top line of /etc/rc.local (it should be at the top so the firewall rules kick in as soon as possible - your AppleTV is effectively unfirewalled until this script has executed!):
 +
/Users/frontrow/firewall_config.sh
  
 
[[Category:How-to]]
 
[[Category:How-to]]

Latest revision as of 03:22, 11 January 2009

Note

The AppleTV seems to ship with no firewall rules configured. There is no need to hack up a way to disable the firewall.


In MacOS X, at boot time,
/usr/libexec/FirewallTool
runs, which reads the file
/Library/Preferences/com.apple.sharing.firewall.plist

Neither the binary nor the plist are distributed with the AppleTV OS, and it is therefore not surprising that in a default OS install, the ipfw kext has a single 'allow any' default rule:

-bash-2.05b$ sudo ipfw list
65535 allow ip from any to any

Enabling the Firewall

It is likely that copying over FirewallTool from an Intel Mac will enable MacOS firewall configuration at boot time. In addition, it is neccesary to create /Library/Preferences/com.apple.sharing.firewall.plist. If the prefs plist file does not exist, FirewallTool will not configure ipfw. There are several ways to create this file:

Enabling the Firewall without an Intel Mac

It's possible to set up the firewall without using any GUI, and this appears to work (tested on a v2.1 AppleTV) without copying the plist or any other files from an Intel Mac. Be warned - using this method it's quite likely that your machine will be un-firewalled for a short time during boot-up, before the firewall rules script takes effect.

Create the following file as firewall_config.sh in /Users/frontrow. It can serve as a base set of firewall rules to get you started - if you want more google for "ipfw". Don't forget you must change the IP address under the comment 'Allow anything from LAN' depending on your own LAN's ip address range.

#!/bin/sh
sudo ipfw -f flush
#sudo ipfw -f list

#exclude loopback traffic
sudo ipfw add 00003 allow all from any to any via lo0

#Deny any spoofed loopback/multicast traffic
sudo ipfw add 02010 deny log ip from 127.0.0.0/8 to any in
sudo ipfw add 02020 deny log ip from any to 127.0.0.0/8 in
sudo ipfw add 2030 deny log ip from 224.0.0.0/3 to any in
sudo ipfw add 2040 deny log tcp from any to 224.0.0.0/3 in

#Allow outgoing/established
sudo ipfw add 02050 allow tcp from any to any out
sudo ipfw add 02060 allow tcp from any to any established

#Allow anything from LAN
sudo ipfw add 02070 allow ip from 192.168.0.0/24 to any

#Block everything else
sudo ipfw add 12190 deny log tcp from any to any
sudo ipfw add 65535 allow ip from any to any

Make sure this script is executable

chmod 755 firewall_config.sh

Add the following to the top line of /etc/rc.local (it should be at the top so the firewall rules kick in as soon as possible - your AppleTV is effectively unfirewalled until this script has executed!):

/Users/frontrow/firewall_config.sh