🎯 Purpose
✅ Turn on the macOS application firewall with incoming connections blocked and stealth mode enabled.
➡️ Matches the firewall checks in E8‑COMPLY‑MacOS, so devices can meet them.
👥 Who is affected
✅ Devices: All macOS devices
🚫 Exclusions: None
☁️ What is protected
✅ Inbound network connections to macOS devices
✅ Template: Endpoint security › Firewall › macOS Firewall
🔐 How the firewall is enforced
Setting | Value |
Enable Firewall | True |
Block All Incoming | True |
Enable Stealth Mode | True |
➡️ The Mac does not accept incoming connections and does not respond to network probes such as ping.
ℹ️ Note: Block All Incoming stops services such as screen sharing and file sharing from accepting connections. Use a separate policy for devices that need these services.
⚙️ What this policy does NOT enforce
🚫 Per‑app firewall rules
🚫 Outbound filtering
🚫 Network Protection or web filtering
🟢 Policy status
✅ Enabled
✅ Assigned to all devices
📘 Essential Eight Alignment
✅ Reduces the network attack surface of macOS devices
✅ Lets devices pass the firewall checks in E8‑COMPLY‑MacOS
ℹ️ Inforcer Best Practice control applied at all maturity levels
📘 Practical Interpretation (Executive‑Friendly)
This policy ensures that:
✅ Macs can't be reached from the network by attackers
✅ Macs stay invisible on untrusted networks such as public Wi‑Fi