A Mac firewall for outgoing connections

Why the macOS firewall doesn't stop apps connecting out

macOS has a firewall built in, in System Settings → Network → Firewall, and it is worth keeping on. But it is about incoming connections: it decides which apps may accept connections from other computers. It has no setting for outgoing ones, so it can't stop an app on your Mac from connecting to a server on the internet.

Outgoing traffic is where most of the questions are. Which apps phone home in the background? Where does a free utility send data? Can you use an app offline on purpose, or keep an old version from nagging you to update? For that you need an outgoing firewall, and that is what Tidy My Mac's Firewall is.

See which apps connect to the internet

Open Firewall and the Recent Connections tab fills in as apps open outgoing connections. Each row is one app, with its icon and name, and underneath it the remote addresses and ports it connected to, most recent first. Hover over the line to see them all.

• An app with connections open right now shows how many, such as 3 open. One that has gone quiet shows when it was last seen.
• Apps that are part of macOS are marked macOS, so you can tell them from the apps you installed.
• Connections are grouped by app, not by process. Browsers and other apps do much of their networking in helper processes inside their bundle; those are listed under the app they belong to.
• Tools outside an app bundle, such as curl or a Homebrew command, are listed under their own name.

The list is collected while the Firewall screen is open, checking every few seconds, and shows the apps running under your own account. It doesn't run in the background, so it costs nothing when you aren't looking at it. You don't need to turn the firewall on to see it.

Block an app from the internet with one click

Click Block on any app in Recent Connections, or select several and click Block Selected. To block an app that hasn't connected yet, open Blocked Apps, click Add App… and pick it from Applications.

A blocked app can't open new outgoing connections. Blocking applies to the whole app, helpers included: blocking a browser blocks every process inside its bundle. Connections that were already open when you blocked it stay up until they close; quit and reopen the app to cut them all at once.

The Blocked Apps tab lists every app you blocked and when. Click Unblock and it is back online on its next connection. Tidy My Mac never blocks itself, whatever is on the list.

How it works

The Firewall is a network content filter, a system extension built on Apple's Network Extension framework. macOS hands it each new outgoing connection, the extension looks up which app opened it, and drops the connection if that app is on your block list. It never looks at what the connection carries. Incoming connections are left to the macOS firewall.

macOS only runs a system extension from an app in your Applications folder, so Tidy My Mac needs to be there for the firewall to start.

Good to know

• Apps are matched by where they are on disk. If you move or rename a blocked app, it is no longer blocked; add it again from its new place.
• Some apps hand downloads to a macOS background service instead of making the connection themselves. That traffic belongs to the macOS service, not the app, so blocking the app doesn't stop it.
• The Firewall decides by app, not by site. To block particular sites for every app, use Web Protection.