Control the macOS Firewall with socketfilterfw

The pf-style GUI firewall is driven by /usr/libexec/ApplicationFirewall/socketfilterfw — fully scriptable.

macOSsocketfilterfwfirewallMedium risk

Run `/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate` to check status, and `--add <app>` / `--setstealthmode on` (with sudo) to manage rules.

01Command

Command

$ /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --add /Applications/MyApp.app
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on

02What it does

macOS's built-in application firewall is a separate layer from pf, and its CLI lives at the surprisingly long path `/usr/libexec/ApplicationFirewall/socketfilterfw`. Key operations: `--getglobalstate`/`--setglobalstate on|off` toggles the firewall, `--add`/`--remove` manage per-application rules, and `--setstealthmode on` makes the Mac ignore unsolicited probes including ping. `--listapps` prints every app with a rule, which is how you discover an old entry blocking a port you need.

03Risk

RiskMedium risk

!Warning: The application firewall allows signed apps by default; adding a rule for a renamed or re-signed binary creates duplicate entries that behave differently.

04Undo

Undo

$ sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate off

05Sources

socketfilterfw — macOS Command Reference
SS64 · technical · 2026-09-17
Evidence: Command reference for socketfilterfw flags.
Block connections to your Mac with a firewall
Apple Support · vendor-doc · 2026-09-17
Evidence: Describes the macOS application firewall, per-app rules, and stealth mode that socketfilterfw configures.

Last verified: 2026-09-17 · Category: Security & Privacy