How can I enable the firewall via command line on Mac OS X?

I can use the Security & Privacy preference pane to enable and disable the firewall, but how can I do it with the command line - something with defaults write maybe?

2 Answers

Enable the application firewall via

defaults write /Library/Preferences/com.apple.alf globalstate -int 1

(0 to disable), and restart the services

launchctl unload /System/Library/LaunchAgents/com.apple.alf.useragent.plist
launchctl unload /System/Library/LaunchDaemons/com.apple.alf.agent.plist
launchctl load /System/Library/LaunchDaemons/com.apple.alf.agent.plist
launchctl load /System/Library/LaunchAgents/com.apple.alf.useragent.plist

The application firewall can be controlled with the /usr/libexec/ApplicationFirewall/socketfilterfw binary.

See here for further information.

Note that the application firewall is entirely different from the BSD packet filter, that can be configured with the ipfw command line utility.

With MacOS Mojave, you can enable the MacOS Application Firewall with:

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on

For more information check out the socketfilterfw man page or:

/usr/libexec/ApplicationFirewall/socketfilterfw -h (for help)

I did not have to unload or load the daemon (com.apple.alf)

Using 'socketfilterfw' amends the plist /Library/Preferences/com.apple.alf.plist setting 'globalstate' to 1 (on).