Firewall Stealth Mode in Sierra not working

I enabled Stealth Mode in the Application Firewall (rebooted) on two separate (brand new) iMacs, but both respond to ping on local subnet and remotely. Anyone else have problems?

iMac (21.5-inch, Late 2015), Mac OS X (10.7.5), i7- 18

Posted on Apr 6, 2017 3:33 PM

Reply
6 replies

May 10, 2017 10:42 PM in response to Pagrash

Read two articles : OS X Yosemite: Prevent others from discovering your Mac

: OS X Yosemite: Prevent unwanted connections by using a firewall


A firewall can protect your Mac from unwanted contact initiated by other computers when you’re connected to the Internet or a network. If you turn on a sharing service, such as file sharing, OS X opens a specific port for the service to communicate through. When you open the Firewall pane of Security & Privacy preferences, any sharing services turned on in Sharing preferences, such as File Sharing or Remote Apple Events, appear in the list.

In addition to the sharing services in Sharing preferences, the list may include other services or apps that are allowed to access your Mac from another system. For example, an app might have requested and been given access through the firewall, or it might have a trusted certificate and therefore allowed access.

Important: Certain apps have access through the firewall even though they don’t appear in the list. These can include system apps, services, and processes as well as digitally signed apps that are opened automatically by other apps. You can block access through the firewall for these programs by adding them to the list.


Turn on firewall protection

  1. Choose Apple menu > System Preferences, click Security & Privacy, then click Firewall.
  2. Click the lock icon User uploaded file to unlock it, then enter an administrator name and password.
  3. Click Turn On Firewall.
  4. To specify additional security settings, click Firewall Options and do any of the following:
    • Allow only specified apps and services to connect: Click Add User uploaded file, then select the app or service in the dialog that appears.
    • Allow only essential apps and services to connect: Select the “Block all incoming connections” checkbox.
    • Allow signed software to receive incoming connections: Select the “Automatically allow signed software to receive incoming connections” checkbox.

Apr 7, 2017 11:37 AM in response to Pagrash

Hello Pagrash,
Thank you for using Apple Support Communities.

I understand from your post that you have enabled stealth mode in the application firewall on two different iMacs, but both are still responding to pings. Verify that the applications you are using to ping the iMacs are not authorized applications as the computers will still answer incoming requests from authorized applications.

OS X: About the application firewall - Apple Support

Enable stealth mode

Enabling stealth mode prevents the computer from responding to probing requests. The computer still answers incoming requests for authorized apps. Unexpected requests, such as ICMP (ping) are ignored.

Best Regards.

May 10, 2017 5:04 AM in response to Pagrash

Hello Pagrash,


I am actually having same issue on my old 2007 MacBook Pro, but in a different OS X version, where I have Mavericks 10.9.5 installed. Looks like "Stealth Mode" is not doing anything after enable or disable it, as I can get pings from "localhost" using Terminal, regardless of it is enable.


However, and surprisigly, I have another MBP, but from 2012, and this one have exactly same OS X version installed (10.9.5), and Stealth Mode is working as it should be, because, when I try to ping from locahost also using Terminal, it says "request timeout - 100% packet lost", so it is refusing pings from anywhere, it is working correctly on this machine.


I have no idea why Stealth Mode in my old MBP is not working well. Is there any way to restore or rebuild all Firewall structure to "original mode" ? What are the files that control Firewall in Mavericks ? Was told that the one file is "com.apple.alf.plist", but absolutely no idea about this ?


Any help would be much appreciated 🙂

May 10, 2017 5:05 AM in response to sterling r

Hello Sterling,


I am actually having same issue on my old 2007 MacBook Pro, but in a different OS X version, where I have Mavericks 10.9.5 installed. Looks like "Stealth Mode" is not doing anything after enable or disable it, as I can get pings from "localhost" using Terminal, regardless of it is enable.


However, and surprisigly, I have another MBP, but from 2012, and this one have exactly same OS X version installed (10.9.5), and Stealth Mode is working as it should be, because, when I try to ping from locahost also using Terminal, it says "request timeout - 100% packet lost", so it is refusing pings from anywhere, it is working correctly on this machine.


I have no idea why Stealth Mode in my old MBP is not working well. Is there any way to restore or rebuild all Firewall structure to "original mode" ? What are the files that control Firewall in Mavericks ? Was told that the one file is "com.apple.alf.plist", but absolutely no idea about this ?


Any help would be much appreciated 🙂🙂

May 10, 2017 5:15 PM in response to Gl7-9M

Hello GI7-9M,

The cause of my issue seems to be related to using Migration Assistant to pull a configurations from OS X 10.11 (El-Capitan) systems running PF firewall with Murus GUI. To solve the problem, I ended up adding MURUS settings to Block ICMP from everywhere except the local subnet. However, I have not been able to get any type of Firewall logging to work, as this seems to be a problem with Sierra. So I tested it by pinging from the local subnet and a remote subnet, and found that it worked.


I hope this helps.


P

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Firewall Stealth Mode in Sierra not working

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.