Turning of firewall on Sequoia

[paczo]

Hi everyone,

I've been facing an issue with internet connections just after updating to macOS Sequoia. Two devices running Sequoia cannot establish a connection with each other in Docker.

Error response from daemon: Get "https://europe-docker.pkg.dev/v2/": net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)

This issue started right after I installed the update, and I've heard about DNS/connection issues related to it. The first thing I wanted to test was turning off the firewall, but I wasn't able to make any changes.

I have a policy that was supposed to turn off the firewall with the following command:

defaults write /Library/Preferences/com.apple.alf globalstate -int 0

However, it didn't work on Sequoia, although I tested it on Sonoma and it worked well there.

I've tried searching online but haven't found anything that works so far. My question is: Does anyone have any ideas on how to disable the firewall? I tried following the procedure outlined here: https://forum.itarian.com/t/mac-procedure-to-disable-firewall/75670/3, but nothing happened. I received a message that "Firewall settings cannot be modified from the command line on managed Mac computers."

[AJPinto]

I don't have the details handy but Apple did make changes to the macOS firewall with macOS 15. These changes broke a bunch of stuff with 15.0 prompting apple to release 15.0.1 pretty soon after in September. I don't recall any of this being documented terribly well. The bugs have been sorted out as far as I am aware. However, if you are managing the firewall with a configuration profile don't expect terminal commands to work to change firewall settings.

[paczo]

Actually, I just checked and one device with this issue is running macOS 15.0.0, but the last sync in Jamf was on 30/12/2024, so I’m not really sure if that’s accurate.
I just asked for confirmation and updating the OS.

Anyway, by the way, off-topic, how can i turn off the firewall if needed? 

[sdagley]

@paczo Use a Configuration Profile with a Security and Privacy - Firewall payload to control the macOS Firewall.

And do NOT deploy macOS 15.0 in your environment as it has major issues with the System Extension API when the macOS firewall is enabled. macOS 15.0.1 would be your minimum, with 15.1.1 or later being preferred.

[paczo]

Thanks!

I've created a Configuration Profile called 'Firewall - Allow Docker,' which permits changes to FW settings, as shown in the screenshot where I added my computer. Additionally, I added an exclusion for the same laptop in another profile named 'Firewall' where changes are restricted. Despite these settings, the firewall is still locked.

I'm new to Jamf, having worked with this product for only a month. Could there be another location where the FW policy is defined?

[sdagley · Accepted solution]

If you enable the Firewall setting then it will force the firewall to be on regardless of the "Firewall settings change" setting. If you want to have an exception for Docker then you need to enable the "Control incoming connections for specific apps" option and add Docker (with Bundle ID of com.docker) to the list of specific apps. 

[paczo]

Thank you all for your support; I truly appreciate it, especially as I navigate the beginning of my Jamf journey. :) Upgrading macOS to version 15.2 resolved all the network issues.

Could I ask one more thing? I understand that using macOS 15.0 could pose security risks. Is it possible to exclude or ignore that specific version, while still allowing updates, so that we skip version 15.0 altogether

[sdagley]

Don't defer macOS updates and all of your users should see macOS 15.2 as an available update via Software Update.