How can I enable the firewall via command line on Mac OS X?

Enable the application firewall via

defaults write /Library/Preferences/com.apple.alf globalstate -int 1

(0 to disable), and restart the services

launchctl unload /System/Library/LaunchAgents/com.apple.alf.useragent.plist
launchctl unload /System/Library/LaunchDaemons/com.apple.alf.agent.plist

launchctl load /System/Library/LaunchDaemons/com.apple.alf.agent.plist
launchctl load /System/Library/LaunchAgents/com.apple.alf.useragent.plist

The application firewall can be controlled with the /usr/libexec/ApplicationFirewall/socketfilterfw binary.

See here for further information.

Note that the application firewall is entirely different from the BSD packet filter, that can be configured with the ipfw command line utility.

With MacOS Mojave, you can enable the MacOS Application Firewall with:

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on

For more information check out the socketfilterfw man page or:

/usr/libexec/ApplicationFirewall/socketfilterfw -h (for help)

I did not have to unload or load the daemon (com.apple.alf)

Using 'socketfilterfw' amends the plist /Library/Preferences/com.apple.alf.plist setting 'globalstate' to 1 (on).