diff --git a/etc/cmake/options.cmake b/etc/cmake/options.cmake
index 9d31ecac0..fc1a39bec 100644
--- a/etc/cmake/options.cmake
+++ b/etc/cmake/options.cmake
@@ -360,6 +360,11 @@ if(OT_UPTIME)
     target_compile_definitions(ot-config INTERFACE "OPENTHREAD_CONFIG_UPTIME_ENABLE=1")
 endif()
 
+option(OT_FIREWALL "enable firewall")
+if (OT_FIREWALL)
+    target_compile_definitions(ot-config INTERFACE "OPENTHREAD_POSIX_CONFIG_FIREWALL_ENABLE=1")
+endif()
+
 option(OT_FULL_LOGS "enable full logs")
 if(OT_FULL_LOGS)
     if(NOT OT_LOG_LEVEL)
diff --git a/src/posix/platform/openthread-posix-config.h b/src/posix/platform/openthread-posix-config.h
index 2bb116672..49de56500 100644
--- a/src/posix/platform/openthread-posix-config.h
+++ b/src/posix/platform/openthread-posix-config.h
@@ -202,14 +202,6 @@
  * ip6tables -A $OTBR_FORWARD_INGRESS_CHAIN -p ip -j ACCEPT
  *
  */
-#ifdef __linux__
-#if OPENTHREAD_CONFIG_BORDER_ROUTER_ENABLE & OPENTHREAD_CONFIG_PLATFORM_NETIF_ENABLE
-#ifndef OPENTHREAD_POSIX_CONFIG_FIREWALL_ENABLE
-#define OPENTHREAD_POSIX_CONFIG_FIREWALL_ENABLE 1
-#endif
-#endif
-#endif
-
 #ifndef OPENTHREAD_POSIX_CONFIG_FIREWALL_ENABLE
 #define OPENTHREAD_POSIX_CONFIG_FIREWALL_ENABLE 0
 #endif