On this page
The Mac firewall is in System Settings > Network > Firewall. Turn it on with the switch at the top. It stops other computers from starting connections to your Mac. It doesn’t stop apps on your Mac from connecting out, which is what most people expect a firewall to do.
Turn the firewall on
- Open System Settings.
- Click Network in the sidebar, then Firewall.
- Turn on the Firewall switch. You may need to enter your Mac password.
To check from Terminal:
/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstateIt prints Firewall is enabled. (State = 1) when it’s on.
What the firewall blocks, and what it doesn’t
Apple describes the firewall as protection against unwanted contact started by other computers.
| Blocked by the Mac firewall? | |
|---|---|
| Another device connecting to File Sharing or Screen Sharing | Yes, unless you allow it |
| A game or app hosting a connection others join | Yes, until you click Allow |
| Your browser loading a page | No |
| An app checking for updates | No |
| Malware uploading your files | No |
Everything in the bottom three rows starts on your Mac, so the macOS firewall lets it through. The firewall matters most on networks you don’t control, such as cafés, hotels and airports, where strangers’ devices share the network with yours.
What each option does
Click Options on the Firewall page to see these.
Block all incoming connections. Blocks everything except what macOS needs to get online (DHCP and IPsec). It also blocks sharing services such as File Sharing and Screen Sharing. Useful on public Wi-Fi.
The app list. Apps that have asked to accept incoming connections, each set to Allow incoming connections or Block incoming connections. Click the add button (+) to add an app yourself, or change an entry from the menu next to it.
Automatically allow built-in software to receive incoming connections. Lets Apple’s own software accept connections without asking you.
Automatically allow downloaded signed software to receive incoming connections. Lets apps from identified developers accept connections without asking. Turn this off if you’d rather be asked about each app.
Enable stealth mode. Your Mac stops answering network test requests such as ping, so other devices find it harder to discover. Connections you start still work.
You can read each setting from Terminal too:
/usr/libexec/ApplicationFirewall/socketfilterfw --getblockall --getstealthmodeWhen macOS asks about an app
With the firewall on, an app that isn’t on the list and tries to accept a connection brings up this question:
Do you want the application “App name” to accept incoming network connections?
Click Allow if you know the app and expect it to receive connections: a game hosting a match, a screen-sharing tool, a local development server. Click Deny otherwise. You can change your answer later in the app list.
If you want to control outgoing connections
The macOS firewall has no setting for outgoing connections. For that you need an app that asks you when a program tries to connect out. Options include:
- LuLu: free and open source, from Objective-See.
- Little Snitch: paid, with detailed rules and a network map.
- Radio Silence: paid, blocks apps from connecting without pop-ups.
Running one of these alongside the macOS firewall is normal. The macOS firewall handles incoming connections and the other app handles outgoing ones.
Should you turn it on?
On a laptop that joins public networks, yes. It costs little: apps that need incoming connections ask once, and everything else keeps working. On a desktop at home behind a router, it matters less, because the router already blocks most connections from the internet. It still protects you from other devices on your home network.
What a firewall can’t do
A firewall controls connections, not what an app does once you’ve allowed it. Outgoing firewalls have limits too. Objective-See notes that some of Apple’s own system traffic skips the network filters that apps like LuLu use, so no such app sees all of it.
Frequently asked questions
Is the Mac firewall on by default?
Often not, so check yours. Open System Settings > Network > Firewall: if the switch is off, turn it on.
Does the Mac firewall slow down the internet?
No. It only checks connections that other devices try to start, which is a small share of your traffic.
Will turning on the firewall break AirDrop?
Not with the default settings. AirDrop stops working only if you turn on Block all incoming connections.
Do I need a firewall if I have a router?
Your router blocks connections from the internet. The Mac firewall also blocks other devices on the same network, which matters most on public Wi-Fi.
Sources
- Apple Support, Block connections to your Mac with a firewall.
- Apple Support, Change Firewall settings on Mac.
- Objective-See, LuLu.
- Setting names, the prompt wording and Terminal output read on macOS 26.0.1 (25A362), 31 October 2026.
How we tested. Every step was checked on macOS 26.0.1 (25A362), MacBook Pro (16-inch, 2021), 31 October 2026. Menus and wording can differ on other versions of macOS.
