After reading the OS X security guide, I used ipfw. It works ok in Mountain Lion. Here is what I did:
Create a file named /etc/ipfw.conf with the following content:
add 1000 deny tcp from any to any dst-port 80 via en0
add 2000 deny tcp from any to any dst-port 80 via en1
You may want to go for slightly different set of rules (like block all but allow "lo0" interface) if you use a USB modem.
Create a file named /Library/LaunchDaemons/ipfw.plist with the following content:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://
www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>ipfw</string>
<key>Program</key>
<string>/sbin/ipfw</string>
<key>ProgramArguments</key>
<array>
<string>/sbin/ipfw</string>
<string>/etc/ipfw.conf</string>
</array>
<key>RunAtLoad</key>
<true />
</dict>
</plist>
Register with launchd:
launchctl load -w /Library/LaunchDaemons/ipfw.plist
Check that rules are registered:
ipfw print
You should get:
01000 deny tcp from any to any dst-port 80 via en0
02000 deny tcp from any to any dst-port 80 via en1
65535 allow ip from any to any
The last rule is needed!
Now you can try to connect from another computer to your own and check that connection is blocked. Note that you are always able to connect from your own computer to your own computer. Try your smartphone or friend's computer.