Mac Firewall: How to Turn It On and Choose the Right Settings

Every Mac comes with a firewall, but it’s switched off out of the box. Turning it on takes about ten seconds and adds a quiet layer of protection, especially when you’re working from public Wi-Fi.

This guide explains what the Mac firewall actually does, how to turn it on, what each option means, and when you might want something more.

What the Mac firewall does (and doesn’t do)

The macOS firewall is an application firewall. Instead of managing ports and rules by hand, it decides which apps and services on your Mac are allowed to accept incoming network connections.

That’s the key word: incoming. The built-in firewall:

• Blocks unsolicited connection attempts from other devices on the network or the internet to apps on your Mac.
• Asks you the first time an unlisted app wants to accept incoming connections, so you can allow or deny it.
• Lets signed apps and built-in services through automatically, if you keep the default options.
• Can hide your Mac from network probes with stealth mode.

It does not:

• Monitor or block outgoing connections, such as an app phoning home or sending data to a server.
• Scan for or remove malware.
• Protect you from phishing, malicious websites or downloads you open yourself.

Your web browsing, streaming and downloads aren’t affected, because those are replies to connections your Mac started. The firewall only steps in when something on the network tries to start a conversation with your Mac.

Feature	Built-in macOS firewall	Third-party outbound firewall
Blocks unwanted incoming connections	Yes	Yes (most)
Shows and blocks outgoing connections	No	Yes
Per-app rules	Yes, incoming only	Yes, both directions
Stealth mode	Yes	Varies
Price	Free, built in	Free (LuLu) or paid (Little Snitch)

Should you turn on the firewall on your Mac?

For most people, yes. It’s free, it uses almost no resources, and you’ll rarely notice it’s there.

How much it matters depends on where you use your Mac:

• Laptop on public Wi-Fi (cafés, hotels, airports, conferences, coworking spaces): turn it on. You share these networks with strangers, and the firewall keeps them from reaching services on your Mac.
• Home network behind a router: your router already keeps the internet from reaching your Mac directly, so the firewall adds less. It’s still a sensible default, and it protects you from other devices on the same network.
• Work or school Mac: your IT team may manage the firewall for you. If the settings are grayed out, that’s why.

The firewall matters most if you use sharing features like File Sharing, Screen Sharing or Remote Login, or run apps that listen for connections, such as development servers, media servers or games that host multiplayer sessions.

Tip: The firewall is one small piece of a secure Mac. Keeping macOS up to date matters far more. Our guide to whether Macs need antivirus covers the rest of Apple’s built-in protection.

How to turn on the firewall on Mac

These steps work on macOS Ventura, Sonoma, Sequoia and macOS 26 Tahoe.

1. Choose Apple menu › System Settings.
2. Click Network in the sidebar.
3. Click Firewall. You may need to scroll down.
4. Turn on Firewall.
5. Enter your login password or use Touch ID if asked.

That’s it. The firewall is now active with Apple’s default options, which suit most people.

On macOS Monterey and earlier, the firewall lives in System Preferences › Security & Privacy › Firewall. Click the lock to make changes, then click Turn On Firewall.

Note: If the Firewall switch is dimmed or missing, your Mac may be managed by an organization through a configuration profile. Ask the person or IT team who set it up.

Mac firewall options explained

Once the firewall is on, click Options on the same screen to fine-tune it. If Options is dimmed, turn on Firewall first. Make your changes, then click OK.

Block all incoming connections

This blocks incoming connections to everything except the basic services your Mac needs to work on a network, like finding devices and getting a network address. All sharing services, including File Sharing and Screen Sharing, are blocked.

Use it when you want maximum protection on an untrusted network and don’t need any sharing features. Leave it off day to day, because it’s the setting most likely to break things like AirPlay to your Mac or screen sharing.

Automatically allow built-in software to receive incoming connections

Lets Apple’s own apps and services, which are signed by a valid certificate authority, accept incoming connections without asking you. Keep this on unless you have a specific reason not to.

Automatically allow downloaded signed software to receive incoming connections

Lets apps you’ve downloaded that are signed with a valid developer certificate accept incoming connections without asking. With this on, you’ll see fewer prompts. Turn it off if you’d rather approve each app yourself.

Enable stealth mode

Your Mac stops responding to “ping” requests and to connection attempts on closed TCP or UDP ports. Anyone scanning the network has a harder time noticing your Mac exists, while apps you’ve allowed keep working normally.

It’s a good choice for laptops. The only downside is that some network troubleshooting tools that rely on ping won’t get a reply from your Mac.

Allow or block specific apps

The list in Options shows apps and services that have firewall rules.

1. Click the Add button (+) under the list.
2. Choose an app, then click Add.
3. Use the menu next to the app to choose Allow incoming connections or Block incoming connections.

To remove a rule, select the app and click the Remove button (–).

When an app that isn’t on the list tries to accept a connection, macOS shows an alert asking whether to allow or deny it. Until you answer, connections to it are denied. If you don’t recognize the app and didn’t just open something that needs network access, choose Deny. You can always change it later.

Warning: Blocking an app can stop it, or other software that depends on it, from working properly. If something breaks after you block it, set it back to allow.

Recommended settings

Option	Laptop on public Wi-Fi	Desktop on home network
Firewall	On	On
Block all incoming connections	On while traveling, if you don’t need sharing	Off
Automatically allow built-in software	On	On
Automatically allow downloaded signed software	On	On
Enable stealth mode	On	Optional

How to check the Mac firewall in Terminal

If you manage several Macs, or just want a quick check, you can query the firewall from Terminal. Open Terminal from Applications › Utilities.

Check whether the firewall is on:

/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate

Check stealth mode:

/usr/libexec/ApplicationFirewall/socketfilterfw --getstealthmode

List the apps that have firewall rules:

/usr/libexec/ApplicationFirewall/socketfilterfw --listapps

These commands only read settings. To turn the firewall on from Terminal, use sudo and enter your login password when asked (it won’t appear as you type):

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on

Changes made this way show up in System Settings too. For everyday use, System Settings is the simpler route.

Outbound firewalls: when you want more control

The built-in firewall is about who can reach your Mac. If you also want to know when apps on your Mac reach out, and stop the ones you don’t trust, you need an outbound firewall. These show an alert the first time an app connects to a server, so you can allow or block it and build rules over time.

They’re most useful for privacy-minded people who want to see which apps send data, and for anyone who wants an extra signal if unfamiliar software starts making connections. Expect more prompts in the first few days while you teach it your apps.

LuLu

Best for: A free, no-frills outbound firewall · Price: Free · Website

LuLu is made by Objective-See, a nonprofit that builds free, open-source Mac security tools. It alerts you when an app tries to connect out, lets you allow or block it, and remembers your choice. The source code is public on GitHub.

Little Snitch

Best for: Detailed control and a visual network monitor · Price: Paid, with a free demo · Website

Little Snitch from Objective Development is the long-standing, more polished option. Beyond allow-or-block alerts, it includes a network monitor that shows every connection by app, server and country, plus rule groups and profiles for different networks.

Both apps install a network extension, and macOS will ask you to approve it in System Settings. After a major macOS upgrade, check that the extension is still enabled, since an outbound firewall that has been switched off won’t always make that obvious.

Tip: You can run an outbound firewall alongside the built-in one. Keep the macOS firewall on for incoming connections, and let LuLu or Little Snitch handle outgoing traffic.

Troubleshooting the Mac firewall

Most firewall problems come from one setting or one outdated rule. Start here.

AirPlay to your Mac stopped working

If other devices can’t find your Mac as an AirPlay receiver, open System Settings › Network › Firewall › Options and turn off Block all incoming connections. Then check that AirPlay Receiver is turned on in System Settings › General › AirDrop & Handoff.

If you’re having trouble sending from your Mac to a TV instead, see our guide to AirPlay from Mac to TV.

Screen Sharing, File Sharing or Remote Login is blocked

These services are switched on in System Settings › General › Sharing. When a sharing service is on, macOS lets it through the firewall, unless Block all incoming connections is on. Turn that option off and try again. For more ways to connect, see our guide to remote access on Mac.

If you want the tightest setup, turn off any sharing services you don’t use. That closes them entirely, which is better than relying on the firewall.

An app keeps asking for permission, or can’t accept connections

Some apps, especially ones that aren’t signed by their developer, prompt again after an update because the updated app looks different to the firewall. Open Options, select the app, click Remove (–), then open the app and choose Allow when asked.

If an app such as a game, media server or development tool can’t accept connections, look for it in the list and make sure it’s set to Allow incoming connections.

The firewall settings are grayed out

Your Mac is likely managed by a company or school. Check System Settings › General › Device Management for a configuration profile (on macOS Ventura, look in Privacy & Security › Profiles). Ask your administrator before changing anything.

Everything is broken and you want a fresh start

Turn the firewall off, restart your Mac, turn it back on and leave Options at their defaults. Then allow apps one at a time as they ask.

The bottom line

Turn on the Mac firewall, add stealth mode if you use a laptop, and leave the rest at Apple’s defaults. It keeps strangers on shared networks from reaching your Mac and almost never gets in your way. If you want to see what your apps send out, add LuLu or Little Snitch on top.

For Apple’s own instructions, see Block connections to your Mac with a firewall and Change Firewall settings on Mac.