Firewall settings resetting themselves by a previously uninstalled app

Found this on another forum

"Ventura 13.2, I've reverted to using CLI, it's been an always reliable method vs the completely unreliable GUI. Once applied via CLI, GUI seems to correctly display.

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --blockapp, --listapps, --set/get stealth, allowsignedapp etc

Man ref https://www.manpagez.com/man/8/socketfilterfw/

Same workaround described here Ventura internal Firewall (v13.1) - Apple Community exception being I've found a reboot is not required."

It worked for me.

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setblockall on --setsteathmode on

Original Source: https://www.reddit.com/r/mac/comments/11hiuyl/firewall_options_macos_not_saving_after_closing/?onetap_auto=true

Have this exact same issue and posted about it here couple weeks ago. No response yet so I thought I’d bump yours. Try using “hide system settings” instead of “close system settings” for now. Hiding will still tuck it away, but preserve what firewall settings you chose. When you restart the computer you’ll have to deny and delete those connections again. Sleep mode will preserve them however.

Hopefully we get a legitimate answer soon.

what is the point of your comment?

if you're an employee of Apple, or have any financial interest directing your attention this way -fix it. Shut the heck up, and fix it. Your condescending replies aren't contributing anything of value.

His statement is not condescending, it's just stating a fact. We've been getting post after post regarding the firewall not stopping any incoming. Give this a try in order as needed:

1 - Create and log into a new, basic, admin user account, Set up users, guests, and groups on Mac,  and see if the problem persists. This tells us if the problem is limited to your user account or is system wide.

Note:  do not launch any 3rd party apps in the account so as to not install any of the supporting files that most create.

If the problem isn't present then your original account has software installed that is causing the problem.  

2 - boot into Safe Mode according to How to use safe mode on your Mac and test to see if the problem persists. Reboot normally and test again.

NOTE 1: Safe Mode boot can take up to 3 - 5 minutes as it's doing the following; 

• Verifies your startup disk and attempts to repair directory issues, if needed

• Loads only required kernel extensions (prevents 3rd party kernel/extensions from loading)

• Prevents Startup Items and Login Items from opening automatically

• Disables user-installed fonts 

• Deletes font caches, kernel cache, and other system cache files

NOTE 2: if you have a wireless keyboard with rechargeable batteries connect it with its charging cable before booting into Safe Mode. This makes it act as a wired keyboard as will insure a successful boot into Safe Mode.

When you removed the app, did you actually use the app developer's uninstaller to fully remove the app as it may contain items placed into the bowels of macOS. Make sure to follow the developer's instructions for properly uninstalling the software. If you already removed parts of the software, then you may need to reinstall the app in order to run the uninstaller...it varies between different apps, so you must always check the developer's instructions for properly uninstalling their apps.

You mentioned "Parallels Toolbox". Is this a Windows app you were using, or is it an extra addition for the Parallels VM, or an actual macOS native app? This is extremely important information and needs to be made extremely clear.

If this was a macOS native app or even a Parallels addition, then run EtreCheck and post the report here using the "Additional Text" icon which looks like a piece of paper. If the app installed any macOS drivers or Launch Agents/Daemons, then this report will show whether any of those items still remain behind.

I may not be able to do much to assist you, but this information will be important for other more knowlegeable contributors to assist you. Details are extremely important. FYI, Some contributors, myself included, may skip responding to a thread if details are lacking as it usually involves more time & work to deal with...keeping in mind that we are just other regulars users such as yourself trying to assist people to share our knowledge.

I just spent nearly an entire day trying to figure out why I cannot connect my macs for file sharing.. this is the reason.

It's pretty disheartening to see how long this has been going on. I literally just updated my iMac and NOTHING HAS CHANGED.

I'm honestly sick and tired of this sh1t.

WTFapple233 wrote:

I just spent nearly an entire day trying to figure out why I cannot connect my macs for file sharing.. this is the reason.

Impossible. People are complaining that the application firewall isn’t blocking anything. It can’t be preventing your Macs from connecting because it doesn’t actually block anything.

Why do you think anyone here works for Apple. The Terms of Use specifically point out this is a user to user support forum.

If you want Apple to fix anything, you should contact them.

Why do you think the Application Firewall (or really, any software "firewall") provides any useful function?

A Firewall is a network management tool. It doesn't provide any sort of security. Mostly it just causes problems.

WTFapple233 wrote:

what is the point of your comment?

I was pointing out that you are complaining about behaviour of the Apple Application firewall that is directly contradictory to both its intended design and its buggy, realized behaviour.

if you're an employee of Apple, or have any financial interest directing your attention this way

I am not an employee of Apple and I have zero interest, financial or otherwise, in any security theatre apps. My interest is in seeing people better use their devices. As part of that, when I see people having trouble with the Apple Application firewall, I try to explain how it has little to no actual functionality and no one should be wasting any of their time on it.

-fix it. Shut the heck up, and fix it.

As I previous stated, I'm not an Apple employee so I can't fix Apple's software. In the past, I have written some apps that address Apple shortcomings and/or fix problems that people experiencing. Sometimes those problems are Apple's responsibility and sometimes they aren't.

Your condescending replies aren't contributing anything of value.

Well, this thread was started on February 11th. The person who started it abandoned it months ago. One person noticed that this (the original topic of discussion) is a well-known problem. I don't know if it has since been fixed or not. It is a moot point since the app doesn't even work in the first place, so fixing this bug doesn't have any real meaning, which is probably why it is such a low priority.

Then, over a month goes by and you show up complaining about something totally different and, in fact, completely opposite to what everyone else is experiencing, adding obscene, rude, and insulting comments. And you say I'm the one not contributing anything of value?

Just found this as well.

https://forums.macrumors.com/threads/another-bug-in-macos-13-2-ventura-this-time-its-the-firewall-options.2380134/

Might be something to work off of. Good luck.