How to start pfctl at boot Before El Capitan I used to enable pfctl at boot by adding -e to the start up parameters.

In /System/Library/LaunchDaemons/com.apple.pfctl.plist

&lt;string&gt;/sbin/pfctl&lt;/string&gt;
&lt;key&gt;ProgramArguments&lt;/key&gt;
&lt;array&gt;
    &lt;string&gt;pfctl&lt;/string&gt;
    &lt;string&gt;-e&lt;/string&gt;                &lt;---- this line
    &lt;string&gt;-f&lt;/string&gt;
    &lt;string&gt;/etc/pf.conf&lt;/string&gt;
&lt;/array&gt;


Now I am not able to edit the file anymore (because of System Integrity Protection).

Is there a way to achieve the same without disabling System Integrity Protection?
Is there a way to achieve the same without disabling System Integrity Protection?


Yes*, in System Preferences / Security &amp; Privacy / Firewall Options..., check "Enable stealth mode" and turn on Firewall.

Somehow this enables PF. You can check by running sudo pfctl -s info.

*Tested on High Sierra and Mojave