macOS · Network & Internet
Block unwanted incoming network connections
The built-in Firewall controls which apps and services are allowed to accept incoming network connections, adding a layer of protection against unauthorized access while connected to any network.
How to open Firewall
- Open System Settings → Network → Firewall
- Turn on Firewall
- Click Options to review or add per-app rules
- Enable Stealth Mode under Options for additional protection
What you should know
- Per-app rules to allow or block incoming connections
- Stealth Mode to prevent the Mac from responding to network probes
- Automatically allows signed apps and built-in services by default when enabled
- Firewall logging for reviewing blocked connection attempts
Why it matters
On shared or untrusted networks, such as public Wi-Fi, an active firewall reduces the attack surface by blocking unsolicited incoming connections that could otherwise probe for open services or vulnerabilities. It is a foundational, low-effort security layer that works underneath whatever apps you are running, complementing rather than replacing safe browsing habits and up-to-date software.
Best practices
- Turn on Stealth Mode when frequently using public or untrusted networks
- Review the app rules list periodically and remove entries for apps you have uninstalled
- Allow incoming connections only for apps you specifically expect to receive them, such as file-sharing or remote-access tools
- Keep the firewall enabled by default and only disable temporarily for specific troubleshooting
Common problems and fixes
- A local network app like a media server cannot be discovered
- Add the app to the Firewall's allowed list, or temporarily disable the firewall to confirm it is the cause before permanently allowing it.
- File sharing between Macs on the same network fails
- Confirm File Sharing is both enabled in Sharing settings and allowed through the Firewall's app rules.
- Firewall setting reverts after a major macOS update
- Re-enable Firewall and re-add custom app rules if a major upgrade reset network preferences.
Tips and tricks
- Combine Stealth Mode with disabling unused sharing services in Sharing settings for a tighter security posture on public networks.
- Check Firewall Options' logging output when diagnosing why a specific local app cannot connect.
Frequently asked questions
Does the Firewall block outgoing connections too?
No, macOS's built-in Firewall primarily manages incoming connections, not outgoing traffic.
Is Stealth Mode the same as being invisible on a network?
It prevents the Mac from responding to certain network probing techniques like ping, but the Mac can still be visible through other means such as file sharing announcements.
Do I still need the Firewall if I use a VPN?
Yes, a VPN encrypts and routes traffic but does not replace the local incoming-connection filtering the Firewall provides.
Related settings
- VPN & Network ProfilesVPN settings let you connect to a private network over an encrypted tunnel — common for remote work — while Network preferences let you manage multiple connection profiles, proxies, and advanced TCP/IP settings for different locations or services.
- Screen Sharing & Remote LoginScreen Sharing lets you view and control another Mac's screen remotely (or let someone control yours), while Remote Login enables secure command-line (SSH) access to your Mac from another computer. Both are toggled independently under Sharing settings.
- Wi-Fi ConnectionWi-Fi settings let you join, manage, and prioritize wireless networks on your Mac, including hidden networks and networks that require a captive-portal sign-in.
More Network & Internet guides for macOS
- Bluetooth DevicesBluetooth settings let you pair and manage wireless accessories such as keyboards, trackpads, mice, headphones, and speakers with your Mac.
- AirDrop & HandoffAirDrop lets you wirelessly send files, photos, and links directly to nearby Apple devices without email or messaging apps, while Handoff lets you start something on one Apple device — like a browser tab or email draft — and pick it up instantly on your Mac.
- EthernetEthernet settings manage wired network connections through built-in Ethernet ports or USB and Thunderbolt adapters, including IP configuration, DNS, and connection priority relative to Wi-Fi.
- ProxiesProxy settings let you route web and other network traffic for a given network connection through a specified proxy server, either configured manually or automatically via a PAC file or auto-discovery protocol.
- Thunderbolt BridgeThunderbolt Bridge creates a direct, high-speed network connection between two Macs connected with a Thunderbolt cable, useful for fast file transfers or Target Disk Mode-style workflows without a router.
- Personal HotspotPersonal Hotspot settings let a Mac connect to the internet through a nearby iPhone or iPad's cellular data connection, either automatically via Instant Hotspot or by manually joining the hotspot network.