Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am working through the security guide from apple (which they did not update since Snow Leopard). In the firewall section it states that ipfw has a default allow rule:

65535 allow ip from any to any

And if you enable the firewalls 'stealth mode' via the settings the following rule should be added:

33300 deny icmp from any to me in icmptypes 8

The funny thing is: I have stealth enabled and I do not see this rule when doing

sudo ipfw print

Any idea where stealth mode is enforced if not in the ipfw ruleset?

share|improve this question
up vote 2 down vote accepted

Recent versions of OS X use primarily use the application firewall, not ipfw. In the app firewall, you can enable stealth mode with the command:

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on

Note that this only takes effect if the app firewall is running. To enable it from the command line, use:

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
share|improve this answer
Thanks! Do you have any resources at hand that describe the socketfilterfw in more detail? – er4z0r Oct 9 '12 at 20:03
There doesn't seem to be much documentation, although google will point you at various people's experimentation & results. For the socketfilterfw command itself, /usr/libexec/ApplicationFirewall/socketfilterfw -h is the best resource I know. – Gordon Davisson Oct 10 '12 at 2:34
Played around with that. Thx. – er4z0r Oct 12 '12 at 8:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .