What it does, and doesn't
Apple describes the firewall as protection from unwanted contact started by other computers (Apple, Block connections to your Mac with a firewall). It's an application firewall: rather than working with port numbers, it decides which apps and services on your Mac may accept incoming connections.
- It does stop a device on the same network, or on the internet, from connecting to a service on your Mac you haven't allowed.
- It doesn't filter outgoing traffic. An app on your Mac can still connect to any server. Intego, a Mac security company, makes the same point in its 2026 guide to the firewall (Intego, How to enable and configure the macOS firewall).
- It doesn't stop malware you download and open yourself. That's the job of Gatekeeper and XProtect (what they cover).
Should you turn it on?
Intego notes that macOS ships with the firewall turned off, so unless you or your organization switched it on, yours may be off. Our view:
- A MacBook you take out: turn it on. On public and shared Wi-Fi, the other devices on the network aren't yours.
- A Mac that only uses your home network: the benefit is smaller, because the other devices are yours. There's little downside to having it on, though.
- A Mac you share files or the screen from: turn it on and keep the default options; sharing services you've switched on keep working.
- A managed work Mac: leave it to IT. If the setting is locked, that's why.
Check whether it's on
Open System Settings › Network and look at Firewall. Or, in Terminal, read the state without changing anything and without a password:
/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
/usr/libexec/ApplicationFirewall/socketfilterfw --getstealthmodeOn our MacBook Pro with macOS 27.0.1, they printed Firewall is enabled. (State = 1) and Firewall stealth mode is off. The same tool's --set… options change settings and need sudo; System Settings is the simpler way to change anything.
Turn on the firewall
The steps are the same on macOS 15 Sequoia, macOS 26 Tahoe and macOS 27 (Apple, macOS 15; macOS 26; macOS 27):
- Choose Apple menu › System Settings, then click Network in the sidebar.
- Click Firewall (you may need to scroll down).
- Turn on Firewall. macOS may ask for an administrator password.
- Click Options if you want to change what's allowed. The button is greyed out until the firewall is on.
The options, explained
These are the names macOS 27.0.1 uses, with Apple's descriptions (Apple, Change Firewall settings on Mac):
| Option | What it does | Our suggestion |
|---|---|---|
| Block all incoming connections | Blocks everything except what basic internet services need, such as DHCP and IPSec. macOS warns that it also blocks file sharing, screen sharing and media sharing | Off, unless you're on a network you don't trust at all |
| The app list (+ and –) | Apps and services you've answered for, each set to Allow incoming connections or Block incoming connections | Review now and then; remove apps you no longer use |
| Automatically allow built-in software to receive incoming connections | Lets Apple's own apps and services through without asking | On |
| Automatically allow downloaded signed software to receive incoming connections | Lets apps signed with a valid certificate through without asking | On for most people; off if you want to be asked about every app |
| Enable stealth mode | Your Mac stops responding to probing requests, such as pings, that could reveal it's there | On for travel if you like; Intego says you generally won't need it at home |
On our Mac, both "Automatically allow" options were on, and stealth mode and Block all were off.
When an app asks to accept connections
With the firewall on, an app that isn't on the list and isn't let through automatically triggers an alert asking whether to allow or deny incoming connections. Apple notes that until you answer, connections to it are denied, and that blocking an app can interfere with it or with software that depends on it (Apple).
Allow it if you know why the app needs to be reached from other devices: a multiplayer game you host, a media server, a file-transfer app, a development server you're testing on your phone. Deny it if you don't. You can change the answer at any time in the app list under Options. If a sharing feature stops working after you turn the firewall on, check that Block all incoming connections is off and that the app is set to allow.
Outgoing connections: a different job
If what you want is to see or block what apps on your Mac connect to, that takes a separate app. Two well-established ones, checked 20 October 2026:
- LuLu from the non-profit Objective-See Foundation: free and open source, it blocks unknown outgoing connections until you allow them. Version 4.5.3, for macOS 10.15 or later, checked 23 October 2026.
- Little Snitch from Objective Development: a paid network monitor and firewall that shows an alert when an app wants to connect, with a map of connections. A single licence for Little Snitch 6 was 59 € in the developer's shop; without a licence it runs in a demo mode that stops after three hours and can be restarted.
Both ask about a lot of connections in the first days, which is the point and also the cost. Neither replaces Gatekeeper or XProtect.
How Tend helps
Tend's free Security check shows whether the firewall is on, next to FileVault, Gatekeeper, System Integrity Protection and XProtect's version. It only reads the setting; you change it in System Settings › Network.
Questions
Should I turn on the firewall on my Mac?
On a MacBook that joins public or shared Wi-Fi, yes: it stops other devices on the network from connecting to apps and services on your Mac that you haven't allowed. With the default options, signed apps are let through automatically, so it rarely gets in the way. On a home network the benefit is smaller, but there's little downside.
Where is the firewall on a Mac?
In System Settings › Network › Firewall, on macOS 15, 26 and 27. Turn on the Firewall switch, then click Options to choose which apps may accept incoming connections.
Does the Mac firewall block outgoing connections?
No. The built-in firewall controls incoming connections to apps and services on your Mac. To see or block what apps on your Mac connect to, you need a separate app such as the free LuLu or the paid Little Snitch.
What is stealth mode on a Mac?
A firewall option that stops your Mac responding to probing requests, such as pings, that could reveal it's on the network. It's useful on untrusted networks; at home you generally don't need it, and it can get in the way of network troubleshooting.
Why does my Mac ask whether to allow incoming network connections?
An app that isn't on the firewall's list wants to accept connections from other devices. Apple says connections to it are denied until you answer. Allow it if you know why the app needs it, such as a game, media server or file-sharing app; otherwise click Deny. You can change your answer later in the firewall options.
Related guides
What is XProtect on Mac, and do you still need antivirus?
The protection that stops malware you download
FileVault on Mac: should you turn it on?
The other security switch worth checking
How to check a Mac for malware and remove it
If you think something got through
“Apple could not verify” a Mac app: what to do
Gatekeeper's warning, explained
Sources
- Apple, Block connections to your Mac with a firewall: macOS 15, macOS 26, macOS 27
- Apple, Change Firewall settings on Mac
- Intego, How to enable and configure the macOS firewall (1 July 2026, third party)
- Objective-See, LuLu; Objective Development, Little Snitch and shop; checked 20 October 2026
- Apple,
man socketfilterfw; firewall settings text and command output from our MacBook Pro (M2 Max) with macOS 27.0.1, 20 October 2026
Check your firewall and FileVault in one place
Tend is free to download. Pro is $1.99 a month, $12.99 a year with a 7-day free trial, or $29.99 once.