Description:
The macOS Application Layer Firewall (ALF) controls inbound network connections on a per-application basis. Unlike traditional port-based firewalls, it operates at the application level and blocks or allows connections based on the application attempting to receive them.
Rationale:
Enabling the Application Layer Firewall prevents unauthorized inbound network connections to the device. Without the firewall enabled, any application or service can accept incoming connections, increasing the attack surface. The firewall helps block malicious remote access attempts, unauthorized services, and network-based exploits targeting macOS applications.
Impact:
Blocks unauthorized inbound network connections to applications on the Mac.
Reduces the attack surface from network-based exploits and unauthorized remote access.
Operates at the application level providing more granular control than port-based firewalls.
Some applications may prompt for firewall permission when first launched.
Does not affect outbound connections — only inbound connections are filtered.
Default Value:
By default, the Application Layer Firewall is turned off on macOS. It must be turned on through System Settings, Terminal, or an MDM configuration profile.
Pre-Requisite:
macOS 11 Big Sur or later. (The menu path differs between macOS 13 Ventura and later and macOS 12 Monterey and earlier — both are shown below.)
Administrator privileges on the device.
Remediation:
Test Plan:
Pre-Implementation Check (run before making any changes)
Open Terminal (Applications > Utilities > Terminal) and check the current firewall state:
Expected on a non-compliant Mac: Firewall is disabled. (State = 0). If it shows Firewall is enabled. (State = 1), the firewall is already on and no changes are needed.
Post-Implementation Check (run after completing the Implementation Steps)
Run the same command again:
Expected output: Firewall is enabled. (State = 1)
You can also confirm in System Settings > Network > Firewall, where the Firewall switch should be ON. On macOS 12 Monterey and earlier, System Preferences > Security & Privacy > Firewall shows “Firewall: On”, as in the example below.
Screenshot: Firewall turned on (System Preferences, macOS 12 Monterey and earlier).
Implementation Steps:
Option A: Using System Settings
Step 1: Open System Settings
Click the Apple menu and select System Settings.
Step 2: Go to Network > Firewall
Click Network in the left sidebar, then click Firewall. On macOS 12 Monterey and earlier, go to System Preferences > Security & Privacy > Firewall instead, and click the lock icon at the bottom to make changes.
Step 3: Turn on the Firewall
If the Firewall switch is OFF, click it to turn it ON (on macOS 12 and earlier, click Turn On Firewall). Enter your administrator password if asked.
Step 4 (optional, recommended): Turn on Stealth Mode
Click Options and turn on “Enable stealth mode”. This stops the Mac from responding to network probes such as ping, so it is harder to discover on public networks.
Option B: Using Terminal
Instead of Option A, run the following command and enter your administrator password when prompted:
Expected output: Firewall is enabled. (State = 1)
Optional (recommended) — turn on stealth mode:
Backout Plan:
Step 1: Open the Firewall settings
Go to System Settings > Network > Firewall (on macOS 12 and earlier: System Preferences > Security & Privacy > Firewall, then click the lock icon).
Step 2: Turn off the Firewall
Click the Firewall switch to turn it OFF (on macOS 12 and earlier, click Turn Off Firewall).
Alternatively via Terminal:
If stealth mode was turned on, it can be turned off with:
Note: With the firewall off, any app or service on the Mac can accept incoming connections. Turn it back on as soon as possible.
Note:
Protects you on public networks: When connected to public Wi-Fi (airports, cafes, hotels), other devices on the same network may attempt to connect to your Mac. The firewall blocks these unauthorized connection attempts automatically.
Prevents unauthorized remote access: Without the firewall, open ports and services on your Mac can be discovered and targeted by attackers. The firewall blocks these attempts before they reach your system.
Reduces risk if malware is present: The firewall stops malicious software from accepting incoming connections from attackers. Note that it does not block outgoing connections.
Managed Macs: If the Mac is managed by MDM and the firewall setting is greyed out, it is controlled by a configuration profile — contact your IT administrator to change it.