I can use the Security & Privacy preference pane to enable and disable the firewall, but how can I do it with the command line - something with defaults write
maybe?
2 Answers
Enable the application firewall via
defaults write /Library/Preferences/com.apple.alf globalstate -int 1
(0 to disable), and restart the services
launchctl unload /System/Library/LaunchAgents/com.apple.alf.useragent.plist
launchctl unload /System/Library/LaunchDaemons/com.apple.alf.agent.plist
launchctl load /System/Library/LaunchDaemons/com.apple.alf.agent.plist
launchctl load /System/Library/LaunchAgents/com.apple.alf.useragent.plist
The application firewall can be controlled with the /usr/libexec/ApplicationFirewall/socketfilterfw
binary.
See here for further information.
Note that the application firewall is entirely different from the BSD packet filter, that can be configured with the ipfw
command line utility.
-
2You need to
sudo
the unload & load of the daemon (/System/Library/LaunchDaemons/com.apple.alf.agent.plist); otherwise it'll try to unload & load them from the user launchd, which won't work right. Do not, however,sudo
the commands for the useragent. Sep 10, 2012 at 13:51 -
On newer versions of macOS restarting the services will fail because of "Operation not permitted while System Integrity Protection is engaged". Disabling SIP is not recommended and quite difficult. As a workaround, restart the computer– treazFeb 10, 2019 at 5:33
With MacOS Mojave, you can enable the MacOS Application Firewall with:
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
For more information check out the socketfilterfw man page or:
/usr/libexec/ApplicationFirewall/socketfilterfw -h
(for help)
I did not have to unload or load the daemon (com.apple.alf)
Using socketfilterfw
amends the plist /Library/Preferences/com.apple.alf.plist
setting globalstate
to 1 (on).