View Active Packet-Filter Firewall Rules with pfctl

Inspect the rules macOS's built-in PF firewall is enforcing, right from the Terminal.

macOSnetworkpfctlfirewallMedium risk

Run sudo pfctl -s rules to list every packet-filter rule currently active on the Mac.

01Command

Command

$ sudo pfctl -s rules

02What it does

macOS includes the BSD packet filter (PF), which underlies the system firewall; VPN clients and security tools often add rules here that never appear in System Settings. pfctl -s rules prints the live rule set, and sudo pfctl -s info summarizes whether the filter is enabled and how much traffic it has seen. Reading the rules is completely safe and a good first step when diagnosing blocked connections.

03Risk

RiskMedium risk

RequirementsAdministrator password for sudo; PF is usually loaded by the application firewall or a management tool.

!Warning: Never experimentally flush or rewrite rules (pfctl -F all) on your daily Mac — a bad ruleset can cut off your network instantly. If nothing is listed, PF may be disabled; sudo pfctl -E loads the default ruleset.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

pfctl - control the packet filter (PF) firewall
SS64 · technical · 2026-09-17
Evidence: Documents pfctl -s rules for listing active PF firewall rules and -E to enable the filter.

Last verified: 2026-09-18 · Category: Security & Privacy