AirDrop with "Block all incoming connections" enabled in macOS Firewall?
Has anyone gotten AirDrop to work with "Block all incoming connections" enabled via the macOS firewall (managed through Jamf)? If not, is there a secure alternative approach? We're trying to mirror our Windows default-deny-with-exceptions model on macOS:…
Has anyone gotten AirDrop to work with "Block all incoming connections" enabled via the macOS firewall (managed through Jamf)? If not, is there a secure alternative approach? We're trying to mirror our Windows default-deny-with-exceptions model on macOS: firewall enabled, policy set to "specific apps only" (AllowSigned/AllowSignedApp = false), with an explicit allow-list of applications — e.g. adding sharingd for AirDrop. Does this sound like a sound approach, or are there gotchas we're missing (entitlements, code-signing checks, mDNS/Bonjour dependencies, etc.)? Any real-world experience — good or bad — appreciated.
Collected discussion
The firewall isn't some magic 'fix' for security, same as 'block all incoming connections' or 'stealth mode'. In general it will only help with two things: - Prevent accidental exposure of listening sockets - Prevent unsanctioned exposure of listening sockets In your scenario, just limiting it to signed should be sufficient. If someone has the means to start a binary with a socket in listening mode, the firewall is going to be the least of your problems.