Securing Your Mac Server with a Firewall

Every server on the internet gets scanned constantly. Automated bots probe for open SSH ports, web services, VNC, databases, anything they can find. Most of these are brute-force attempts or exploit scanners.

A firewall will not make a poorly configured service secure, but it removes most of the noise and limits your exposure to only the ports and source IPs you actually need. If you only access SSH from one or two IPs, there is no reason the rest of the world should be able to reach it.

macOS has two firewalls

macOS ships with two separate firewalls, and they do different things:

Application Firewall (ALF). This is the one in System Settings under "Firewall." It works per application: allow or block incoming connections for specific apps. It is useful on a laptop but too limited for a server. You cannot define rules by port, protocol, or source IP. We do not recommend relying on it for a hosted server.

PF (Packet Filter). This is the real firewall, inherited from OpenBSD. It works at the network level: filter by port, protocol, source/destination IP, and more. It is powerful but has no GUI built into macOS. You configure it through config files or a third-party frontend. This is what you want for a server.

Option 1: Murus (GUI for PF)

If you prefer a visual interface, Murus is a solid frontend for PF. It runs on macOS 10.14.4 and later, supports both Intel and Apple Silicon, and makes PF configuration much easier than editing config files by hand.

Licensing note: Murus Lite is free but only for non-commercial use. If you are running a production server, you need Murus Basic or Murus Pro (which includes Vallum, an application-level firewall). Pro costs around $35, which is reasonable for what you get.

Setting up Murus

Download Murus from murusfirewall.com and drag it to your Applications folder. You will need to enter your admin password a few times during setup, as PF requires root privileges.

Think about your rules first

Before you start clicking, decide what traffic you need:

What ports do your applications need? A web server needs TCP 80 and 443. If you only access the Mac via SSH and VNC, you need ports 22 and 5900. List everything your setup requires.

Who needs access? If only you and your team connect via SSH or VNC, restrict those ports to your IP addresses. This is the single most effective thing you can do. It removes your management interfaces from the public internet entirely.

Are your IPs stable? If you have a static IP at home or office, great. If not, consider whitelisting a range, or multiple IPs you know are relatively stable. Do not whitelist a single dynamic IP unless you have a plan for when it changes.

Configuring inbound rules

In Murus, go to Inbound Rules. Add the services you need to expose. For ports not in the predefined list, create them under Services.

For management ports like SSH and VNC, assign them to a Group containing only the IPs that should have access.

Example setup: open ports 80 and 443 to the world, restrict SSH (22) and VNC (5900) to a group called "Management" with your known IPs.

The lockout safety net

This is the most important thing to know about configuring a firewall remotely: you can lock yourself out. A typo in an IP address or an overly restrictive rule and you lose access. At that point we would need to intervene physically.

Murus has a built-in safety feature for this. When you apply new rules, it starts a 60-second timer. If you still have access, dismiss the timer. If you lost access, the previous rules are automatically restored after the timer expires. Always use this when applying changes remotely.

To apply: click the Play button in the top bar. Murus will ask if you are remotely controlling the computer. Click yes. The timer starts. If everything works, dismiss it. If not, wait 60 seconds and you are back in.

Make rules survive a reboot

By default, PF rules are not persistent across reboots. Once your rules are working, go to Status in Murus and click Install Boot Scripts. Test this by rebooting your server and confirming the rules are still active. Do not skip this step.

Option 2: PF via command line

If you are comfortable with the terminal and prefer not to install additional software, you can configure PF directly. The configuration lives in /etc/pf.conf.

A minimal example that blocks everything inbound except web traffic and SSH from a specific IP:

# Default block all inbound
block in all

# Allow outbound
pass out all

# Allow web traffic from anywhere
pass in on en0 proto tcp to any port { 80, 443 }

# Allow SSH only from your IP
pass in on en0 proto tcp from 203.0.113.50 to any port 22

Load the rules:

sudo pfctl -f /etc/pf.conf
sudo pfctl -e

Check the rules are loaded:

sudo pfctl -sr

To make PF start at boot, you can create a LaunchDaemon or use pfctl -e in a startup script.

Warning: if you are configuring PF manually over SSH, test carefully. Unlike Murus, there is no automatic rollback. One option is to schedule a pfctl -d (disable firewall) via at or launchd a few minutes in the future before applying new rules. If you lock yourself out, PF disables itself and you can reconnect. Cancel the scheduled disable once you confirm access.

If you lock yourself out

If you do get locked out despite precautions, contact us. You can also try a remote reboot via our control portal first. We can access your Mac physically in the data center and fix the firewall rules. But this requires a support request and takes time, so it is worth being careful.

Running multiple Macs? Consider a dedicated firewall

The options above work well when you manage one or a few Macs. But if you are running a larger deployment, maintaining PF rules on each individual Mac does not scale. Rules drift, someone forgets to update a host, and you end up with inconsistent security across your fleet.

For these situations we offer managed firewall services. Instead of each Mac filtering its own traffic, we place your Macs on a private network behind a dedicated firewall. Your servers are no longer directly exposed to the internet. All traffic passes through the firewall, where we manage a central set of rules for you. This also gives you things that are hard to do with per-host PF: VPN access to your private network, outbound filtering, traffic logging, and consistent policy across all your Macs.

If you are interested or want to discuss whether it fits your situation, get in touch and we will walk you through it.

Our recommendation

Set up a firewall. Even a simple one that blocks everything except the ports you need makes a real difference. Restrict management access (SSH, VNC, ARD) to known IPs wherever possible. If you want a GUI, Murus is the best option on macOS. If you prefer the command line, PF is already there.