macOS includes a built-in Application Level Firewall (ALF) that prevents unauthorized applications, programs, and services from accepting incoming network connections. While the firewall is easily enabled via System Settings > Network > Firewall, system administrators managing fleets of Macs via scripts or SSH need a way to enable and configure the firewall directly from the command line. This is accomplished using the socketfilterfw utility.
Step 1: Locate the Utility
The socketfilterfw command is not located in the standard user path. It is buried deep within the CoreServices directory. To avoid typing the full path every time, you can navigate to the directory first or invoke it directly using its absolute path:
/usr/libexec/ApplicationFirewall/socketfilterfwStep 2: Check the Current Firewall Status
To see if the firewall is currently running, use the --getglobalstate flag:
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstateThe output will simply say Firewall is enabled. or Firewall is disabled.
Step 3: Enable the Firewall
To turn the firewall on, use the --setglobalstate flag followed by on:
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate onStep 4: Configure Stealth Mode
Enabling Stealth Mode prevents the Mac from responding to ping requests (ICMP echo requests) and connection attempts from closed TCP and UDP ports. This makes the Mac virtually invisible on public Wi-Fi networks.
To check the status of Stealth Mode:
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getstealthmodeTo enable Stealth Mode:
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode onStep 5: Configure Application Permissions
By default, macOS will automatically allow built-in Apple software (like file sharing or screen sharing) and downloaded applications signed by valid Apple Developer IDs to receive incoming connections. If you want to enforce strict security and block everything except essential system services, you can enable “Block All” mode.
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setblockall onWarning: Enabling block-all mode will immediately break file sharing, screen sharing, and third-party servers running on the Mac.
Step 6: Managing Exceptions
If you need to manually allow a specific application through the firewall, you must add it to the trusted list and then explicitly allow it.
First, add the application to the firewall list:
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --add /Applications/MyApp.appThen, unblock it to allow incoming connections:
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --unblockapp /Applications/MyApp.appUsing socketfilterfw allows administrators to script robust security baselines, ensuring every Mac on the network is protected against unauthorized network ingress before it even reaches the hands of the end-user.