/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstateShow whether the firewall is on.
When to use it
Turn the firewall on if you use public Wi-Fi, run apps that open ports (development servers, file sharing), or just want fewer services reachable. It's off by default on macOS, because a fresh Mac has no services listening to the network anyway.
Steps
Turn it on
System Settings › Network › Firewall, then switch it on.Open the options
Click Options… to see app rules and the global switches.Enable stealth mode
Enable stealth mode stops the Mac answering pings and probes to closed ports, so it's less visible on a network.Set rules per app
Click + to add an app and choose Allow incoming connections or Block incoming connections. macOS also asks the first time an unsigned app wants to listen.Check from Terminal
The same settings are available with socketfilterfw./usr/libexec/ApplicationFirewall/socketfilterfw --getstealthmode
Output explained
$ /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
Firewall is disabled. (State = 0)
$ /usr/libexec/ApplicationFirewall/socketfilterfw --getstealthmode
Firewall stealth mode is off
$ /usr/libexec/ApplicationFirewall/socketfilterfw --getblockall
Firewall has block all state set to disabled.
State 0 is off, 1 is on, and 2 is on with Block all incoming connections, which allows only essential services (DHCP, Bonjour, IPsec). That mode also stops AirDrop, file sharing and screen sharing from receiving connections.
Options and variations
| Flag | Meaning | Example |
|---|---|---|
| --getglobalstate / --setglobalstate on|off | Firewall on or off | sudo …/socketfilterfw --setglobalstate on |
| --setstealthmode on|off | Don't answer probes or pings | sudo …/socketfilterfw --setstealthmode on |
| --setblockall on|off | Block all incoming connections | sudo …/socketfilterfw --setblockall on |
| --add PATH / --blockapp PATH | Add an app / block its incoming connections | sudo …/socketfilterfw --blockapp /Applications/App.app |
| --listapps | Show app rules | …/socketfilterfw --listapps |
Common errors
| Error | Cause | Fix |
|---|---|---|
| AirDrop stopped working | Block all incoming connections is on | Turn it off in Firewall Options. |
| An app still connects out | The built-in firewall only filters incoming connections | Use an outbound firewall like LuLu or Little Snitch. |
| Dev server unreachable from phone | The firewall blocks the app (node, python) | Allow it in Options, or when macOS prompts. |
Do it in the app
The firewall decides who may connect in; LightAtom's Ports view shows which apps are listening and whether each port is reachable from the network or only localhost, so you know what the firewall is protecting.
Frequently asked questions
Does a Mac have a firewall?
Yes. macOS includes an application firewall for incoming connections, off by default. Turn it on in System Settings › Network › Firewall.
Should I turn on the Mac firewall?
It's a good idea on laptops that join public Wi-Fi and on Macs that run sharing or development servers. It has little downside: allowed apps keep working.
What does stealth mode do on a Mac?
The Mac stops responding to pings and to connection attempts on closed ports, so network scans see less of it. Allowed services still answer.
How do I block an app from the internet on a Mac?
The built-in firewall only blocks incoming connections. To block an app's outgoing connections, use an outbound firewall such as LuLu (free) or Little Snitch.
Is the Mac firewall the same as pf?
No. The application firewall works per app. pf (pfctl) is a lower-level packet filter that works on addresses and ports; macOS uses it internally and you can configure it for advanced rules.