vBoxx
    Back to help center
    Security, firewalls and encryption

    Securing your Mac server with a firewall

    Why the macOS Application Firewall isn't enough on a server, and how to deploy PF properly.

    8 min read

    Why you want a firewall

    Every IP on the public internet is scanned around the clock. Most of that traffic is automated brute-force or vulnerability probes against SSH, VNC, databases and web servers. A firewall doesn't make a misconfigured service safe, but it removes the noise and limits attack surface to the ports and source IPs you actually use.

    macOS ships two firewalls

    Application Firewall (ALF). The toggle in System Settings → Network → Firewall. Per-app allow/block. Fine for laptops, useless for a server: no port, protocol or source IP rules.

    PF (Packet Filter). Inherited from OpenBSD. Real packet filter, rules by port, protocol, source/destination, state. No GUI by default — use a config file or a frontend. This is what you want.

    Option 1: Murus (PF with a UI)

    Murus is a polished GUI on top of PF.

    • Runs on macOS 10.14.4+ (Intel and Apple silicon).
    • Murus Lite is non-commercial only. Use Murus Basic or Pro on a hosted server.
    • Pro (~$35) bundles Vallum for app-level filtering on top.

    Option 2: PF by hand

    If you're comfortable in Terminal, edit /etc/pf.anchors/vboxx directly. Minimal example that allows SSH from a single office IP and HTTP/HTTPS from anywhere:

    # Allow loopback
set skip on lo0

# Drop noisy junk silently
block in all

# SSH from the office only
pass in proto tcp from 198.51.100.10 to any port 22

# Public web
pass in proto tcp from any to any port { 80, 443 }

# Outbound: allow everything
pass out all keep state

    Load and persist:

    sudo pfctl -e                      # enable
sudo pfctl -f /etc/pf.anchors/vboxx

    Add a LaunchDaemon so the rules survive reboot.

    Recommended baseline for a vBoxx Mac

    1. SSH (22) restricted to specific source IPs.
    2. VNC (5900) blocked publicly — tunnel it through SSH instead, see Accessing your Mac via VNC over SSH.
    3. Public services (web, custom TCP) allowed only from the world they need to serve.
    4. Everything else dropped silently.

    Don't lock yourself out

    Always test new rules in a separate session before enabling them on boot. If you do get locked out, open a ticket — we can connect a console in Amsterdam, Naaldwijk or Frankfurt, but it isn't instant.