Firewall Builder

v1.1.2 BETA

Visual firewall profile builder for macOS MDM

What it generates

Firewall Builder configures macOS firewall settings, application exceptions, stealth mode, and the handling of downloaded signed software. It emits a .mobileconfig XML profile for review before MDM deployment.

Available at no cost in any modern web browser. JavaScript is required to generate output.

Supported vocabulary

Example output

<key>EnableStealthMode</key>
<true/>

When to use it

Use it when firewall policy needs a repeatable profile. Do not use it to infer whether a third-party network product has its own firewall controls.

Generated Profile

How encrypted sharing works

Related: PPPC Builder and Notifications Builder also generate .mobileconfig profiles.

Changelog

Changelog

v1.1.2

  • Corrected the note on the removed EnableLogging and LoggingOption keys: they were valid com.apple.security.firewall payload keys in macOS 12.0–14.6 and were removed by Apple in macOS 15.0 (previously described as "system preference keys only")

v1.1.1

  • Added Block All Incoming conflict warning when app exceptions are configured
  • Added duplicate bundle ID detection in app exceptions
  • Added profile removal behavior note
  • Added URL state sharing

v1.1.0

  • Removed EnableLogging and LoggingOption keys — Apple deprecated and removed them from the com.apple.security.firewall payload in macOS 15.0 (they were valid in macOS 12.0–14.6)
  • Added required field warning for EnableFirewall — Apple's spec marks this as mandatory

v1.0.1

  • Changed boolean toggles to three-state selectors (Enabled / Disabled / Not Configured)
  • Keys set to "Not Configured" are now omitted from the profile instead of defaulting to disabled

v1.0.0

  • Initial release (Beta)
  • Three-state controls (Enabled / Disabled / Not Configured) for all global settings
  • Enable Firewall, Block All Incoming, Stealth Mode configuration
  • Allow Signed and Allow Signed App toggles (macOS 12.3+)
  • Logging with detail level selection (macOS 12.0+)
  • Per-app firewall exceptions with Allow/Block
  • Common app quick-pick for firewall rules
  • Live .mobileconfig XML generation
  • Copy and download profile functionality