Check and Enable the macOS Firewall with socketfilterfw
Turn the built-in macOS application firewall on or off, and allow specific apps, via the socketfilterfw command.
Run sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on to enable the application firewall (check first with --getglobalstate).
01Command
Command
$ sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on02What it does
macOS ships with the application firewall disabled, even though it blocks unsolicited inbound connections from networks you do not trust. The undocumented-but-shipped socketfilterfw tool controls it entirely from the command line: check state with --getglobalstate, toggle it with --setglobalstate, and allow a specific server app with --add /Applications/YourApp.app plus --unblockapp. This is handy for scripts, labs, and quickly hardening a Mac before joining café or hotel Wi-Fi.
03Risk
!Warning: With the firewall on, incoming connections to apps like file sharing or a local dev server may be blocked until you allow them with --unblockapp or accept the prompt macOS shows. Sudo is required for every change.
04Undo
Undo
$ sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate off05Sources
- Block connections to your Mac with a firewallEvidence: Apple's documentation of the macOS application firewall, its default off state, and how it blocks unwanted inbound connections.
Last verified: 2026-09-18 · Category: Security & Privacy