>

Enable Firewall Stealth Mode on macOS

Use socketfilterfw --setstealthmode so the Mac does not respond to pings and network probes.

macOSmacosnetworkhardeningsecurityMedium risk
Run `sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on`, then verify with `--getstealthmode`.

01Command

Command
$ sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on && sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getstealthmode

02What it does

Stealth mode makes macOS's application firewall drop — instead of politely refusing — unsolicited packets like ICMP echo requests and closed-port probes, so port scanners see the machine as offline. It complements the per-app rules: turn the firewall on with --setglobalstate on if it is not already. The trailing --getstealthmode call prints 'Stealth mode enabled' for confirmation, which is handy in setup scripts.

03Risk

RiskMedium risk
RequirementsApplication Firewall present on all modern macOS; sudo.
!Warning: With stealth mode on, your Mac will not answer pings, which can complicate troubleshooting on a trusted LAN.

04Undo

Undo
$ sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode off

05Sources

  • socketfilterfw(8) man page
    Xcode Man Pages (keith.github.io) · technical · 2026-09-17
    Evidence: Man page for socketfilterfw listing the firewall verbs including --setstealthmode and --getstealthmode, alongside --setglobalstate for the application firewall.
  • socketfilterfw(8) - application firewall utility
    ManPagez · technical · 2026-09-17
    Evidence: Mirrors the socketfilterfw man page with the setstealthmode/getstealthmode verbs for the macOS application firewall.

Last verified: 2026-09-19 · Category: Security & Privacy

06Related solutions

Create an Encrypted Disk Image with hdiutil
macOShdiutilsecuritydisk-image

Build an AES-256 encrypted .dmg vault from the Terminal — no Disk Utility clicking required.

Low risk ✓ 2026-09-17
Verify an App's Code Signature with codesign
macOSGatekeepersignaturecodesign

Check whether an application bundle was signed properly and hasn't been modified since.

Low risk ✓ 2026-09-17