usr/libexec/ApplicationFirewall/socketfilterfw –getappblocked /Applications/MyApp.app/Contents/MacOS/myapp usr/libexec/ApplicationFirewall/socketfilterfw -listapps The –listapps option shows the status of each filtered application: usr/libexec/ApplicationFirewall/socketfilterfw -getallowsigned usr/libexec/ApplicationFirewall/socketfilterfw -setallowsigned on Therefore, traffic can be allowed per signed binary. While it would be nice to think that that was going to be everything for everyone, it just so happens that some environments actually need to allow traffic. usr/libexec/ApplicationFirewall/socketfilterfw -setglobalstate on usr/libexec/ApplicationFirewall/socketfilterfw -setloggingopt: detail For example, if you need to troubleshoot some issues, you might set the logging to detail using the following command: You can also control the verbosity of logs, using throttled, brief or detail. usr/libexec/ApplicationFirewall/socketfilterfw -setloggingmode on usr/libexec/ApplicationFirewall/socketfilterfw -getstealthmode usr/libexec/ApplicationFirewall/socketfilterfw -setstealthmode on
The output would be as follows, if successful:įirewall is set to block all non-essential incoming connectionsĪ couple of global options that can be set. usr/libexec/ApplicationFirewall/socketfilterfw -getblockall usr/libexec/ApplicationFirewall/socketfilterfw -setblockall on To configure the firewall to block all incoming traffic: In /usr/libexec/ApplicationFirewall is the Firewall command, the binary of the actual application layer firewall and socketfilterfw, which configures the firewall. To debug, use the following command: “/usr/libexec/ApplicationFirewall/socketfilterfw -d”.If a remote system, do wait and then enable the first time to make sure everything works before enabling the firewall for good. Configure global settings, then per-application settings, then enable the firewall.Whatever you do, you can always reset things back to defaults by removing the file from /Library/Preferences replacing it with the default plist from /usr/libexec/ApplicationFirewall/.Configure the firewall fully before turning it on (especially if you’re doing so through something like Casper, FileWave, Munki, or Absolute Manage where you might kick yourself out of your session otherwise).Some tricks I’ve picked up with the Mac Firewall/alf scripting: However, now there are much more helpful and functional options in socketfilterfw that will allow you to more easily script the firewall. And you will still use socketfilterfw there for much of the heavy lifting. The tools to automate OS X firewall events from the command line are still stored in /usr/libexec/ApplicationFirewall.