Mac firewall: how to turn it on, and what it doesn't block

How to turn on the firewall on a Mac

1. Choose Apple menu › System Settings, click Network in the sidebar, then click Firewall. You may need to scroll down.
2. Turn on Firewall. You may be asked for your administrator password.
3. To change what it allows, click Options, make your changes, then click OK.

To check it from Terminal, run /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate. It answers whether the firewall is enabled or disabled.

What the firewall options do

• Block all incoming connections: refuses connections to every app and sharing service, such as Screen Sharing and File Sharing, except the few macOS needs to get online. Turn it on for a while on a network you don't trust; leave it off if you share files or your screen.
• Automatically allow built-in software to receive incoming connections: lets the apps and services that come with macOS accept connections without asking. Leave it on.
• Automatically allow downloaded signed software to receive incoming connections: does the same for apps signed with a valid developer certificate. Turn it off if you want to be asked about every app.
• Enable stealth mode: your Mac doesn't answer pings and port scans, so it is harder to find on the network. Apps you have allowed keep working. Turn it on if you use public Wi-Fi.

The list above these options holds the apps you have decided about. Use + to add an app and set it to allow or block incoming connections, and − to remove it. When an app that isn't on the list wants to accept connections, macOS asks whether to allow it, and refuses until you answer.

What the Mac firewall doesn't block

The macOS firewall decides which apps may accept connections that other computers start. It has no setting at all for connections your own apps start, and those are nearly all of them: a browser loading a page, an app checking for updates, a utility sending usage data, or malware talking to its server. All of these go through with the firewall on.

That doesn't make it useless. It closes the door on sharing services and apps that listen for connections, which matters most on public Wi-Fi. Your home router does a similar job at home, as long as you don't open ports on it. But to see or stop what your apps send out, you need an outgoing firewall.

Do you need an outgoing firewall?

Most people don't need one to stay safe; antivirus and safe browsing matter more. It is worth having if you want to know which apps connect to the internet in the background, keep an app offline on purpose, stop an old version nagging you to update, or make sure an app you don't fully trust can't send anything.

Outgoing firewalls for Mac

macOS lets other apps add an outgoing firewall through a network extension. These are the best known:

• Little Snitch by Objective Development is the most complete. It asks about each new connection, shows a map of where your apps connect, and has detailed rules by app, server and port. It is a paid app with a 30-day trial.
• LuLu by Objective-See is free and open source. It also asks about each new connection, with simpler rules.
• Tidy My Mac has an outgoing firewall without pop-ups: it lists which apps connect and where, and blocks an app with one click. It is part of the same app as the antivirus and cleanup tools.

Use only one outgoing firewall at a time. Two network extensions filtering the same connections can slow them down or block what you meant to allow.

macOS also has pf, a packet filter you set up in Terminal with configuration files. It can block outgoing traffic by address and port, but not by app, and a macOS update can reset your changes. It is meant for administrators.

The Mac firewall with Tidy My Mac

• Firewall shows which apps connect to the internet, with their helpers counted in, and blocks an app's outgoing connections with one click. Blocking keeps working when Tidy My Mac is closed.
• Security Settings checks that the macOS firewall is on, together with FileVault, Gatekeeper and the other built-in protections.
• Web Protection blocks phishing, scam and malware sites by name, in every browser and app.