The Mac Firewall, Explained

macOS includes a firewall. It filters incoming connections — other machines trying to reach yours. It does not review outgoing connections, so it is not the control that notices data leaving. Both halves of that sentence matter, and most firewall guides only tell you the first.

Turn it on anyway. Then know what it is not doing for you.

Does a Mac have a built-in firewall?

Yes. macOS ships with an application firewall built into the operating system. Apple describes its job plainly: "A firewall can protect your Mac from unwanted contact initiated by other computers when you're connected to the internet or a network." The operative words are initiated by other computers — it governs connections that start elsewhere and arrive at your Mac.

It works per application rather than per port, which is why the settings pane lists apps rather than numbers.

Is the Mac firewall already on?

Don't assume — check. It is not guaranteed to be enabled on a given Mac, and people are often surprised. On the machine used to write this page, running macOS 26.6.1, it was off. You can read the state without changing it:

/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate

which prints either Firewall is enabled. (State = 1) or, as it did here, Firewall is disabled. (State = 0). That command only reads; it changes nothing.

How to turn on the Mac firewall

Verified against macOS 26 (Tahoe) on 2026-08-11.

1. Open the Apple menu > System Settings.
2. Click Network in the sidebar, then click Firewall. You may need to scroll down the Network list to see it.
3. Turn Firewall on.
4. Click Options to review what it allows. The controls there are Block all incoming connections, Automatically allow built-in software to receive incoming connections, Automatically allow downloaded signed software to receive incoming connections, and Enable stealth mode.
5. Leave the two "automatically allow" options on unless you have a specific reason not to, and add or remove individual apps with the Add and Remove buttons.

Enable stealth mode stops your Mac responding to probing requests — useful on public networks, harmless at home, and it does not affect connections you start. Block all incoming connections is stricter than most people want: it blocks incoming connections to nonessential services and apps, which will break screen sharing, file sharing, printer discovery and similar conveniences.

Inbound versus outbound — the difference that matters

Two directions, two very different threat models.

• Inbound is something on the network reaching toward your Mac: a scan, an exposed service, a shared folder you forgot about. This is what the built-in firewall handles.
• Outbound is your Mac reaching out: a browser loading a page, an app checking for updates — and also a program you did not mean to run, sending a copy of your browser profile somewhere.

Infostealer-class malware sits entirely on the outbound side. It does not need to accept an incoming connection. It runs as your user, reads what your user can read, opens an ordinary outbound HTTPS connection to a server, and uploads. To the built-in firewall that traffic is indistinguishable from any other app talking to the internet, because the built-in firewall is not looking in that direction at all.

Turning on the macOS firewall is worth doing and will not stop data leaving. Those are separate controls, and only one of them ships with the Mac.

What outbound monitoring adds

Two well-known macOS tools watch the outbound direction. We link them; we do not bundle, host or redistribute anything.

• LuLu — free and open source, from Objective-See. It alerts when a process tries to make an outbound connection and lets you allow or block it.
• Little Snitch — commercial, from Objective Development. Same category, with a deeper rule system, profiles and traffic visualisation.

What they genuinely give you is visibility and a decision point: an unfamiliar process contacting an unfamiliar host becomes something you see instead of something that happens silently. That is real, and it is the single most useful thing you can add on top of the built-in firewall.

What they do not give you is detection. Neither tool knows whether a program is malicious. They tell you a connection is being attempted and ask you to decide. A signed application talking to a normal-looking domain will look normal, because it is normal — right up until it isn't.

The honest failure mode is alert fatigue. The first week is noisy, and the temptation is to click Allow on everything to make the prompts stop, which converts the tool into a placebo. If you install one, budget the first few days for reading the prompts properly.

LuLu or Little Snitch — how to choose

Both are credible. The split is roughly:

• LuLu if you want the capability at no cost, prefer open source you can read, and are content with allow/block decisions and a simple rule list.
• Little Snitch if you want granular rules, per-network profiles, a map of what has been talking to what, and are willing to pay for the polish and support.

Pick one. Two outbound filters on the same Mac means two network extensions inspecting the same traffic, and neither vendor tests against the other — that is a support problem you do not need.

What a firewall of either kind will not fix

A firewall governs network connections. It has no opinion about the credentials that have already left, and no opinion about how far a single install could reach.

• Sessions and tokens copied from a browser profile are already elsewhere; blocking future connections does not sign anyone out. See why removal isn't recovery.
• Passwords stored in browser autofill remain the highest-value thing on a typical Mac.
• Connected apps and AI tools holding live access to your mail, files or repositories are not network events at all.

The free Mac Exposure Check maps that surface in a few minutes, entirely inside your browser tab. The full settings pass is on the Mac Security Checklist. The paid HardenMac Safety & Recovery Protocol takes the same ground further, into decision gates and the recovery sequence — out now for $29 (founder’s price) via the front page.

Common questions about the Mac firewall

Is the built-in Mac firewall good enough?

For its actual job — refusing unsolicited incoming connections — it is fine, and you should have it on. It is not a general-purpose security control, and it was never meant to be one.

Will the Mac firewall stop an infostealer?

No. That class of malware sends data outward over connections it starts, and the built-in firewall does not review outgoing connections. An outbound monitor such as LuLu or Little Snitch can surface the attempt and let you block it, but only if you read the prompt.

What is the difference between an inbound and an outbound firewall?

An inbound firewall decides which connections from elsewhere may reach your machine. An outbound firewall decides which connections your machine may make to elsewhere. macOS ships with the first. The second is a third-party addition.

Should I turn on stealth mode?

Generally yes. It stops your Mac replying to probes, and it does not affect anything you initiate. The main visible side effect is that your Mac stops responding to ping.

Does "Block all incoming connections" break things?

Often. It blocks incoming connections to nonessential services and apps, so screen sharing, file sharing, printer discovery and similar features stop working. Use it on untrusted networks, not as a permanent setting, unless you know you need none of that.

Do I need a VPN as well?

A VPN and a firewall solve different problems. A VPN changes where your traffic appears to come from and protects it in transit on hostile networks. It does not decide which programs on your Mac may connect, and it does not stop a stealer uploading — it just carries the upload.

Sources

• Apple — Block connections to your Mac with a firewall (macOS Tahoe 26); the quoted description of what the firewall does.
• Apple — Change firewall settings on Mac (macOS Tahoe 26); the Options control labels quoted above.
• Objective-See — LuLu, free and open-source macOS firewall.
• Objective Development — Little Snitch.
• The socketfilterfw --getglobalstate output quoted above was run on macOS 26.6.1 (build 25G76) on 2026-08-11.