>

Manage the macOS Application Firewall with socketfilterfw

socketfilterfw is the hidden CLI behind System Settings' Firewall toggle — enable it, list registered apps, and block specific apps.

macOSsocketfilterfwsecurityfirewallMedium risk
Run `sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on` to enable the firewall; use --listapps and --blockapp to manage apps.

01Command

Command
$ sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on && sudo /usr/libexec/ApplicationFirewall/socketfilterfw --listapps

02What it does

macOS's application firewall is per-app, not per-port: it controls which signed applications may accept inbound connections, which is a different model from pf rules. Useful flags include --setblockall on, --add /path/to/app, --blockapp with --blockapp-protocol, and --getglobalstate to check status. It's the standard way to enforce firewall state in fleet scripts where opening System Settings isn't an option.

03Risk

RiskMedium risk
Requirementssudo (admin account)
!Warning: Blocking an app's inbound connections can break local development servers and AirDrop-style sharing.

04Undo

Undo
$ sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate off

05Sources

  • socketfilterfw(8) — macOS man page
    Xcode Man Pages (mirror) · technical · 2026-09-17
    Evidence: Documents --setglobalstate, --listapps, --blockapp and other controls for the application firewall.

Last verified: 2026-09-17 · Category: Security & Privacy

06Related solutions

Create an Encrypted Disk Image with hdiutil
macOShdiutilsecuritydisk-image

Build an AES-256 encrypted .dmg vault from the Terminal — no Disk Utility clicking required.

Low risk ✓ 2026-09-17
Verify an App's Code Signature with codesign
macOSGatekeepersignaturecodesign

Check whether an application bundle was signed properly and hasn't been modified since.

Low risk ✓ 2026-09-17