Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To turn on the built-in firewall, open Apple menu > System Settings > Network > Firewall, switch Firewall on, then select Options to control incoming connections for individual apps and services. You can allow or block a specific program, block incoming connections to nonessential services, automatically trust signed software, or enable stealth mode. These controls protect connections arriving at your Mac; they are not a complete replacement for account security, updates, safe browsing, or a properly configured network.
Apple’s documented controls and labels can vary slightly by macOS release. The steps below match current System Settings, with the older location and managed-Mac differences covered later.
What the macOS firewall controls
The application firewall is built into macOS and filters incoming network connections to the Mac. It is useful when another computer, device, or service tries to connect to an app listening on your Mac. It is not a general-purpose outbound monitor that asks permission every time an app connects to the internet.
Free tools Windows power users keep installed
One-click scans. No signup required.
When macOS detects an incoming attempt for an app that has not already been added and allowed, it can display an alert asking whether to allow or deny the connection. Until you choose, the attempt is denied. Apple’s instructions and the available controls are described in Block connections to your Mac with a firewall.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
The app list is not a complete inventory of every process with network access. System apps, services and processes can have access without appearing there, and a digitally signed app opened automatically by another app may also be handled as an exception. If you need to block one of those programs, add it to the list explicitly.
Check your macOS version and prerequisites
Current System Settings path
On macOS 13 and later, use Apple menu > System Settings > Network > Firewall. Scroll within Network if Firewall is not immediately visible. Apple’s current Mac Help describes this location in Change Firewall settings on Mac.
Older macOS releases
Apple Platform Security documents the older route as Apple menu > System Preferences > Security & Privacy > Firewall for macOS 12 and earlier. On macOS 13 or later, the equivalent control is in System Settings. If an update has moved the item, open System Settings and search for Firewall rather than guessing at a category.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →What you need
- An administrator account may be required to change firewall settings. If macOS asks for credentials, authenticate with an administrator password or an approved authentication method.
- The firewall must be on before the detailed Options control becomes available.
- Have the app installed and identifiable if you intend to create a per-app rule. You can add an app or service from the file picker when configuring the list.
Turn on the firewall
- Choose Apple menu > System Settings.
- Select Network in the sidebar.
- Open Firewall. Scroll if necessary.
- Turn on the Firewall switch.
- Select Options to see the app and service rules. Apple keeps this button disabled until the firewall is enabled.
Turning on the firewall does not automatically mean that every app must be approved manually. macOS can handle built-in and signed software according to the automatic-allow settings, and some system components do not appear in the visible list.
Choose which apps can accept incoming connections
Add an app or service
- From Network > Firewall, select Options.
- Use Add (the plus button) to open the app or service picker.
- Select the app or service, then choose Add.
- Use the menu beside the new entry to select whether it is allowed or blocked for incoming connections.
- Close the settings pane when finished; macOS applies the rule through the firewall.
Use a per-app rule when you know which program should receive connections. For example, allow a collaboration or media app only when its local-network feature requires inbound traffic, and block a server utility when you do not want it reachable. A blocked rule can stop features that depend on incoming connections, and may also affect other software that relies on that program. Apple cautions that “Blocking an app’s access through the firewall could interfere with or affect the performance of the app or other software that may depend on it.”
Understand the rule states
| Choice | Scope | Likely effect | Use it when |
|---|---|---|---|
| Allow | The selected app or service | Incoming connections to that entry can be accepted. | A known app needs inbound access for a feature you use. |
| Block | The selected app or service | Incoming connections to that entry are refused; dependent features may stop working. | You do not want that specific listener reachable. |
| Not listed | Not necessarily no access | Some system components and signed-app exceptions can still have access. | Do not assume the list is a complete process inventory. |
Respond to a connection alert
If macOS reports that an app is attempting to accept a network or internet connection, choose Allow only when you recognize the app and expect the connection. Choose Deny when the request is unexpected or the app should not provide a network service. You can later add the app in Firewall Options if you need a persistent, explicit rule.
Rank #2
- 【Flexible Port Configuration】1 2.5Gigabit WAN Port + 1 2.5Gigabit WAN/LAN Ports + 4 Gigabit WAN/LAN Port + 1 Gigabit SFP WAN/LAN Port + 1 USB 2.0 Port (Supports USB storage and LTE backup with LTE dongle) provide high-bandwidth aggregation connectivity.
- 【High-Performace Network Capacity】Maximum number of concurrent sessions – 500,000. Maximum number of clients – 1000+.
- 【Cloud Access】Remote Cloud access and Omada app brings centralized cloud management of the whole network from different sites—all controlled from a single interface anywhere, anytime.
- 【Highly Secure VPN】Supports up to 100× LAN-to-LAN IPsec, 66× OpenVPN, 60× L2TP, and 60× PPTP VPN connections.
- 【5 Years Warranty】Backed by our 5-years warranty and free technical support from 6am to 6pm PST Monday to Fridays
Do not approve an alert merely because the app is familiar: check whether you recently enabled a sharing feature, started a local server, or installed an update. Conversely, denying a legitimate request can break discovery, file transfer, remote-control, multiplayer, or other local-network functions.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What each firewall option does
Block all incoming connections
This setting is broader than blocking one app. Apple describes it as blocking incoming connections to nonessential services and apps. Apple Business notes that basic services such as DHCP, Bonjour, and IPsec remain available, while connections to other sharing services are prevented. Enable it when you need a temporary, high-restriction posture and can accept that file sharing, screen sharing, media sharing, or another sharing feature may stop working.
Before selecting it, write down the sharing features you depend on and test them afterward. Turn the setting off again when the restrictive period ends if those services are needed.
Automatically allow built-in software
When enabled, built-in apps and services signed by a valid certificate authority can be added to the allowed list automatically. This reduces prompts for Apple-supplied components, but it also means you are delegating the allow decision to macOS’s signature validation rather than reviewing each entry yourself.
Automatically allow downloaded signed software
This option permits downloaded apps and services signed by a valid certificate authority to be added automatically. It is convenient for software that installs helper services, but it can grant inbound access without a separate prompt. If you want deliberate approval for every newly downloaded listener, leave this automation disabled and handle prompts or list entries manually.
Stealth mode
Stealth mode changes how the Mac responds to unauthorized probing. Apple says that authorized apps can still receive responses, while unauthorized requests such as ICMP ping receive no response. This can make routine scanning less informative, but it does not select which apps may accept connections and does not make the Mac invisible. Keep per-app rules and the broader incoming-connection setting separate from stealth mode.
Rank #3
- 【Flexible Port Configuration】1 Gigabit SFP WAN Port + 1 Gigabit WAN Port + 2 Gigabit WAN/LAN Ports plus1 Gigabit LAN Port. Up to four WAN ports optimize bandwidth usage through one device.
- 【Increased Network Capacity】Maximum number of associated client devices – 150,000. Maximum number of clients – Up to 700.
- 【Integrated into Omada SDN】Omada’s Software Defined Networking (SDN) platform integrates network devices including gateways, access points & switches with multiple control options offered – Omada Hardware controller, Omada Software Controller or Omada cloud-based controller(Contact TP-Link for Cloud-Based Controller Plan Details). Standalone mode also applies.
- 【Cloud Access】Remote Cloud access and Omada app brings centralized cloud management of the whole network from different sites—all controlled from a single interface anywhere, anytime.
- 【SDN Compatibility】For SDN usage, make sure your devices/controllers are either equipped with or can be upgraded to SDN version. SDN controllers work only with SDN Gateways, Access Points & Switches. Non-SDN controllers work only with non-SDN APs. For devices that are compatible with SDN firmware, please visit TP-Link website.
Pick settings by the result you need
| Your goal | Setting to start with | Trade-off to check |
|---|---|---|
| Keep normal use while restricting one listener | Add that app and choose Block. | The app and software that depends on it may lose network features. |
| Permit a known local-network app | Add it and choose Allow, or approve its alert. | Other devices can reach the service while the rule is active. |
| Temporarily stop most inbound services | Enable Block all incoming connections. | Nonessential sharing services and apps will be unavailable; basic DHCP, Bonjour, and IPsec remain available. |
| Reduce responses to probing | Enable Stealth mode. | It does not replace app rules or prevent all network traffic. |
| Reduce prompts for trusted signed components | Enable one of the automatic-allow options. | Matching built-in or downloaded signed software may be allowed without an individual decision. |
Why an app may not appear or may still connect
System and signed exceptions
Apple explicitly notes that some programs can have access even when they are absent from the list. These include system apps, services and processes, plus digitally signed apps opened automatically by other apps. The absence of an entry is therefore not proof that macOS will reject every inbound attempt associated with it.
Add an exception you want to control
If you need to block an app that is handled as an exception, open Firewall Options, select Add, locate the app, and set its menu to Block. Adding it creates an explicit rule that takes precedence over relying on the implicit signed or system behavior. Test the software afterward because a helper process or dependent component may be required for normal operation.
Duplicate or changed app entries
An update can replace an app bundle or change its signing information. If a rule appears ineffective after an update, remove the obsolete entry and add the current app again, then select the intended state. Recheck automatic-allow settings if new helper components continue to appear without prompts.
Troubleshoot common outcomes
A sharing feature stopped working
- Check whether Block all incoming connections is enabled; turn it off temporarily and test.
- In Firewall Options, locate the app or service used by the feature and set it to Allow.
- Check whether a related helper app was blocked. Blocking one component can affect dependent software.
- If the feature still fails, verify its own sharing or network permission settings; the firewall only addresses incoming connections.
You keep receiving prompts
- Confirm that the app is the one you intended to run and that it is signed as expected.
- If it is trusted, add it explicitly in Firewall Options and choose Allow.
- Review the automatic-allow settings. Leaving both disabled can produce more individual decisions; enabling them can reduce prompts for qualifying signed software.
Another device cannot find the Mac
- Check that the relevant app or sharing service is allowed.
- Make sure Block all incoming connections is off if the service is nonessential.
- Remember that stealth mode can suppress responses to unauthorized probes, so a ping test is not proof that the Mac is offline.
- Confirm that both devices are on the expected network and that the app itself is running and configured to share.
The Firewall pane is unavailable or settings revert
On a work or school Mac, a device-management policy may control the firewall. An administrator can enforce whether the firewall is enabled, block incoming connections, specify apps, and enable stealth mode. Your account may be unable to change those values, or a change may be overwritten during the next management check-in.
Managed Macs and administrator policies
Apple provides a Firewall device-management payload for organization-owned or enrolled devices. Its capabilities include enabling the firewall, blocking incoming connections, specifying applications, and enabling stealth mode. Apple’s payload reference lists logging support for macOS 12.0.1 or later and automatic-allow settings for macOS 12.3 or later: Firewall device management payload settings for Apple devices.
Management vendors expose these settings differently. If the controls are missing, locked, or repeatedly reset, contact the organization’s administrator rather than trying to work around the profile. The administrator may need the app’s bundle information, the required sharing behavior, and the macOS version before changing the policy.
Rank #4
- 𝐍𝐞𝐱𝐭-𝐆𝐞𝐧 𝐖𝐢-𝐅𝐢 𝟕 - Optimize performance on latest WiFi 7 laptops and devices, like the iPhone 16 Pro, Samsung Galaxy S24 Ultra, and PS5 Pro with the latest WiFi 7 technology with Multi-Link Operation, Multi-RUs, 4K-QAM, and up to 320 MHz channels.◇△
- 𝟕-𝐒𝐭𝐫𝐞𝐚𝐦, 𝐁𝐄𝟗𝟕𝟎𝟎 𝐓𝐫𝐢-𝐁𝐚𝐧𝐝 𝐖𝐢-𝐅𝐢 𝟕 𝐒𝐩𝐞𝐞𝐝𝐬 - Delivers smooth 4K/8K streaming, immersive AR/VR gaming, and blazing-fast downloads with speeds up to 5,765 Mbps on the 6 GHz band, 2,882 Mbps on the 5 GHz band, and 1,032 Mbps on the 2.4 GHz band.⌂
- 𝐌𝐚𝐱𝐢𝐦𝐢𝐳𝐞𝐝 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞 - Up to 2,600 sq. ft. coverage for up to 120 devices at a time. 6 optimally positioned antennas and Beamforming technology focus Wi-Fi signals toward hard-to-cover areas for stronger coverage-—ideal for those seeking the best WiFi router for large homes.
- 𝟏𝟎 𝐆𝐛𝐩𝐬 𝐏𝐨𝐫𝐭 𝐟𝐨𝐫 𝐌𝐮𝐥𝐭𝐢-𝐆𝐢𝐠𝐚𝐛𝐢𝐭 𝐂𝐨𝐧𝐧𝐞𝐜𝐭𝐢𝐯𝐢𝐭𝐲 - Features 1x 10 Gbps WAN/LAN port, 1x 2.5 Gbps WAN/LAN port, and 3x 2.5 Gbps LAN ports. Integrate with a multi-gig modem for fast, wired gig+ internet.
- 𝐎𝐮𝐫 𝐂𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐂𝐨𝐦𝐦𝐢𝐭𝐦𝐞𝐧𝐭 - TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
Use a staged change when troubleshooting
Change one control at a time so you can identify what fixed or interrupted a feature. First confirm that the firewall is on and that the application itself is running. Next test the narrowest rule: add the specific app and choose Allow. If that restores the feature, leave broad blocking disabled and document the app you approved. If it does not, temporarily turn off Block all incoming connections to determine whether another service is involved, then restore the setting and investigate the dependent component.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →When testing from another device, use the actual feature rather than relying only on a ping. Stealth mode can suppress unauthorized probe responses even while an authorized application works normally. Also test after an app update: a replacement bundle or newly installed helper may generate a new alert or require a fresh list entry.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the firewall does not cover
The application firewall is one layer of macOS security. It does not prove that an app is trustworthy, stop malicious links in a browser, protect a weak account password, or replace timely macOS and app updates. It also does not turn every outbound internet connection into a user approval prompt. Keep the firewall’s scope in mind when investigating suspicious network activity or designing a broader security plan.
Apple’s platform documentation describes the operating-system firewall architecture and its relationship to macOS security controls in Firewall security in macOS. Use that documentation and your organization’s policy when you need controls beyond the per-app incoming-connection choices in System Settings.
A practical setup checklist
- Open System Settings > Network > Firewall and turn the firewall on.
- Select Options and identify any app that must accept incoming connections.
- Add that app or service and choose Allow; add a known unwanted listener and choose Block.
- Decide whether automatic approval for built-in or downloaded signed software fits your risk tolerance.
- Use Block all incoming connections only when you understand which sharing services it will interrupt.
- Enable Stealth mode if you want fewer responses to unauthorized probing, while keeping separate app rules.
- Test the specific local-network or sharing feature you care about, then record any rule that was necessary.
- If settings are locked or revert, check for a management profile and ask the administrator for the approved configuration.
Frequently Asked Questions
How do I turn on the firewall on a Mac?
Open Apple menu > System Settings > Network > Firewall, then turn on Firewall. Select Options afterward to see detailed rules. On macOS 12 or earlier, the path is Apple menu > System Preferences > Security & Privacy > Firewall. If you cannot find it, search System Settings for “Firewall.”
Recommended Free Tools
Why is the Options button disabled?
Apple keeps Options unavailable until the firewall is enabled. Turn on the Firewall switch first, then return to the pane and select Options. An administrator account or authentication may also be required to change the setting.
Best Value
- hEX also known as RB750Gr3 is a five port Gigabit Ethernet router for locations where wireless connectivity is not required
- The device has a full size USB port. This new updated revision of the hEX brings several improvements in performance
- It is affordable, small and easy to use, but at the same time comes with a very powerful dual core 880MHz CPU and 256MB RAM
- IPsec hardware encryption (~470 Mbps) and The Dude server package is supported, microSD slot on it provides improved r/w speed for file storage and Dude
- Dimensions: 113x89x28mm; Storage size: 16 MB; Passive PoE (PoE in); PCB temperature monitor, Voltage monitor and Mode button
How do I allow an app through the Mac firewall?
Open Firewall Options, select Add, choose the app or service, and add it to the list. Use the menu beside the entry to choose Allow. You can also approve an alert when macOS reports that a recognized app is trying to accept a network or internet connection.
Does every app with network access appear in the firewall list?
No. Apple says system apps, services and processes can have access without appearing there. A digitally signed app opened automatically by another app can also be handled as an exception. If you need explicit control, add the app yourself and set it to Allow or Block.
What is the difference between blocking one app and blocking all incoming connections?
A per-app Block rule refuses incoming connections to the selected app and may affect dependent software. Block all incoming connections is broader: it blocks nonessential apps and services, including other sharing services. Basic services such as DHCP, Bonjour and IPsec remain available, but file, screen or media sharing may stop.
Does stealth mode replace app rules?
No. Stealth mode changes responses to unauthorized probing; Apple says requests such as ICMP ping receive no response while authorized apps can still receive responses. It does not choose which apps accept connections, block all inbound services, or make the Mac invisible.
Why did enabling the firewall break file sharing or another local feature?
Check whether Block all incoming connections is enabled and turn it off temporarily. Then locate the app or service used by the feature in Firewall Options and set it to Allow. Also check for a blocked helper app and confirm the feature’s own sharing settings, because the firewall only controls incoming connections.
Why does an app keep getting allowed without a prompt?
The automatic-allow settings can add built-in software or downloaded software signed by a valid certificate authority. System processes and signed apps opened by other apps may also be exceptions. Disable the relevant automatic option if you want more deliberate decisions, or add a specific app and set an explicit Block rule.
Can I change firewall settings on a work or school Mac?
Possibly not. An organization can use a Firewall device-management payload to enforce the firewall state, block incoming connections, specify apps and enable stealth mode. Logging is supported in Apple’s payload reference for macOS 12.0.1 or later, and automatic-allow settings for macOS 12.3 or later. Contact the administrator if controls are locked or revert.
Does the macOS firewall monitor outgoing connections?
The built-in application firewall described here controls incoming connections to the Mac. It is not a general outbound monitor that asks permission every time an app connects to the internet. Use the firewall as one security layer alongside updates, account protection and safe browsing practices.
The Bottom Line
Turn on Firewall in System Settings > Network, then use Options to allow or block specific apps. Reserve Block all incoming connections for situations where you accept losing nonessential sharing, and treat Stealth mode as a probing-response setting rather than an app filter. Signed and system software may not appear in the list, and managed Macs may require administrator changes.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
