diff --git a/DNSCrypt-Preference-Pane/DNSCrypt/extra/usr/scripts/afterboot.sh b/DNSCrypt-Preference-Pane/DNSCrypt/extra/usr/scripts/afterboot.sh
index 0ba375d..a754fc5 100755
--- a/DNSCrypt-Preference-Pane/DNSCrypt/extra/usr/scripts/afterboot.sh
+++ b/DNSCrypt-Preference-Pane/DNSCrypt/extra/usr/scripts/afterboot.sh
@@ -3,4 +3,7 @@
 . ./common.inc
 
 rm -f "$QUERY_LOG_FILE"
+
+./clear-fw.sh
+
 exec ./handle-control-change.sh --boot
diff --git a/DNSCrypt-Preference-Pane/DNSCrypt/extra/usr/scripts/clear-fw.sh b/DNSCrypt-Preference-Pane/DNSCrypt/extra/usr/scripts/clear-fw.sh
new file mode 100755
index 0000000..0373844
--- /dev/null
+++ b/DNSCrypt-Preference-Pane/DNSCrypt/extra/usr/scripts/clear-fw.sh
@@ -0,0 +1,15 @@
+#! /bin/sh
+
+. ./common.inc
+
+exec >/dev/null
+exec 2>&1
+
+SOCKETFILTERFW='/usr/libexec/ApplicationFirewall/socketfilterfw'
+[ ! -x "$SOCKETFILTERFW" ] && exit 0
+
+"$SOCKETFILTERFW" --add        /usr/local/sbin/dnscrypt-proxy
+"$SOCKETFILTERFW" --unblockapp /usr/local/sbin/dnscrypt-proxy
+
+"$SOCKETFILTERFW" --add        /usr/local/bin/hostip
+"$SOCKETFILTERFW" --unblockapp /usr/local/bin/hostip