Firewall Status Check Reference

Configuration options for the firewall status check

Written By Erdinc Akay

Last updated 26 days ago

The firewall status check verifies whether the operating system's built-in firewall is enabled and triggers an alert when it is disabled.

Configuration fields

Field	Type	Required	Default	Description
Warn on disabled	Boolean	No	Yes	Trigger a warning when the firewall is disabled
Critical on disabled	Boolean	No	No	Trigger a critical result when the firewall is disabled (overrides warning)

The check runs on a fixed 60-minute interval.

Firewall enabled / disabled
Per-profile status on Windows (Domain, Private, Public)
A named profile entry on Linux (ufw, firewalld, or iptables) and on macOS (macOS Firewall, plus macOS Firewall (Stealth) when stealth mode is enabled)

Platform	Supported	Firewall technology
Windows	Yes	Windows Firewall (all profiles)
Linux	Yes	ufw, firewalld, or iptables (probed in that order)
macOS	Yes	Application Layer Firewall (ALF)

On Windows, the check inspects all three firewall profiles (Domain, Private, Public). If any profile has the firewall disabled, the check reports a warning (or a critical result, depending on the configured toggles; with both toggles off, the check still reports success).
On Linux, the check probes ufw, firewalld, and iptables in that order and reports on the first one present. A plain iptables setup that accepts all traffic is reported as disabled; it counts as enabled only when it actively drops or rejects traffic.
On macOS, the check reads the Application Layer Firewall state and reports whether it is enabled (including stealth mode).
Third-party firewalls that disable the operating system firewall may trigger a false positive. Exclude those devices or set the check to warning level.