I can use the Security & Privacy preference pane to enable and disable the firewall, but how can I do it with the command line - something with defaults write maybe?
Add a comment
|
2 Answers
Enable the application firewall via
defaults write /Library/Preferences/com.apple.alf globalstate -int 1
(0 to disable), and restart the services
launchctl unload /System/Library/LaunchAgents/com.apple.alf.useragent.plist
launchctl unload /System/Library/LaunchDaemons/com.apple.alf.agent.plist
launchctl load /System/Library/LaunchDaemons/com.apple.alf.agent.plist
launchctl load /System/Library/LaunchAgents/com.apple.alf.useragent.plist
The application firewall can be controlled with the /usr/libexec/ApplicationFirewall/socketfilterfw binary.
See here for further information.
Note that the application firewall is entirely different from the BSD packet filter, that can be configured with the ipfw command line utility.
answered Sep 9, 2012 at 22:09
-
2You need to
sudothe unload & load of the daemon (/System/Library/LaunchDaemons/com.apple.alf.agent.plist); otherwise it'll try to unload & load them from the user launchd, which won't work right. Do not, however,sudothe commands for the useragent. Sep 10, 2012 at 13:51 -
On newer versions of macOS restarting the services will fail because of "Operation not permitted while System Integrity Protection is engaged". Disabling SIP is not recommended and quite difficult. As a workaround, restart the computer– treazFeb 10, 2019 at 5:33
With MacOS Mojave, you can enable the MacOS Application Firewall with:
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
For more information check out the socketfilterfw man page or:
/usr/libexec/ApplicationFirewall/socketfilterfw -h (for help)
I did not have to unload or load the daemon (com.apple.alf)
Using socketfilterfw amends the plist /Library/Preferences/com.apple.alf.plist setting globalstate to 1 (on).
