The Hidden Application Firewall
macOS ships with a built-in Application Layer Firewall (ALF) designed to block incoming network connections to unauthorized applications and services. When a system administrator is troubleshooting network connectivity issues—such as an Nginx web server or a custom database failing to accept inbound connections on a Mac—verifying the exact state of this firewall is the first required step.
While you can open System Settings > Network > Firewall to view a basic toggle switch, this GUI provides no technical detail. To perform a true security audit or to check the status via SSH, you must use the terminal. Because macOS does not use standard Linux firewall tools like iptables or ufw, you must use the proprietary socketfilterfw utility.
Locating the Utility
Unlike standard commands like ls or ping, the socketfilterfw executable is not located in the standard /usr/bin/ path. It is buried deep within the CoreServices framework.
To use it, you must type out the absolute path, or create an alias. The absolute path is:
/usr/libexec/ApplicationFirewall/socketfilterfwChecking the Global Firewall Status
To check if the firewall is currently enabled or disabled globally across the operating system, use the --getglobalstate flag. You do not need sudo privileges just to check the status.
Open the Terminal and run:
/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstateThe output will clearly state one of two things:
Firewall is enabled. (State = 1)Firewall is disabled. (State = 0)
Checking Advanced Security Settings
If the firewall is enabled, it may be running in standard mode, or it may be configured in “Stealth Mode,” which forces the Mac to completely drop all incoming ICMP (ping) requests, making it invisible on the local network.
To check if Stealth Mode is active, run:
/usr/libexec/ApplicationFirewall/socketfilterfw --getstealthmodeAdditionally, you can check if the firewall is set to blindly block all incoming connections, regardless of application exceptions. This is the strictest possible setting.
/usr/libexec/ApplicationFirewall/socketfilterfw --getblockallViewing the Allowed Applications List
If the firewall is running in standard mode, it relies on a list of specific applications that have been granted exceptions (like SSH or screen sharing).
To dump the entire list of allowed and denied applications directly into your terminal, use the --listapps flag:
/usr/libexec/ApplicationFirewall/socketfilterfw --listappsThe terminal will output a massive block of text detailing every single binary executable that the firewall is monitoring. If your custom application is failing to receive network traffic, you should search this list to ensure it hasn’t been explicitly blocked by the ALF engine.