Does the Mac Firewall Block Outgoing Connections?
No. The firewall built into macOS blocks only connections coming in to your Mac. There is no setting inside it that stops an app on your Mac from reaching out to a server on the internet. That is not a bug or an oversight, it is the scope of the feature, and it has been true of every version of macOS.
This surprises almost everyone, because “firewall” sounds like it should cover both directions. It matters because the thing most people actually want, which is knowing what their apps are contacting and stopping some of it, is exactly the thing the built-in firewall cannot do.
What does the macOS firewall actually block?
It stops other machines from starting connections to yours. You switch it on in System Settings, then Network, then Firewall. Once on, it can also be told to block all incoming connections, or to allow specific apps to receive them.
That is genuinely useful, particularly on a shared office network, a hotel, or a cafe. If you run any kind of server on your Mac, or you have file sharing or screen sharing switched on, the firewall is what decides who may reach it. Apple’s own documentation describes it precisely this way: it is about connections to your Mac.
Turn it on. It costs one click and it is the right default. Just do not expect it to answer a different question.
Why is there no setting for the outgoing direction?
Because the decision is not one an operating system can make for you. Whether Photoshop should be allowed to contact Adobe, or whether some background program should reach a server in another country, depends entirely on what you want and what you consider acceptable. There is no correct answer macOS could ship.
So Apple provides the mechanism rather than the policy. macOS includes an official system service that lets an app sit in the path of every connection your Mac makes and decide what happens to it. Firewall apps use that service. Apple does not ship a policy of its own on top of it.
How can I tell which direction a connection is?
Direction is about who knocked first, not which way the data travels. Once any connection is open, information moves in both directions. The label describes who started it.
| What is happening | Who started it | The name for it |
|---|---|---|
| Your browser loading a page | Your Mac | Outgoing |
| An app checking in with its maker | Your Mac | Outgoing |
| An app reporting what you did | Your Mac | Outgoing |
| Someone on the same network probing your Mac | The other machine | Incoming |
| A colleague connecting to a folder you shared | The other machine | Incoming |
Notice that everything in the “your Mac started it” half is the part people worry about, and it is the entire half the built-in firewall does not touch.
What do I need for the outgoing direction?
A separate firewall app. Several exist, and they differ far less in what they can do than in how they treat you while doing it.
The prompting kind, which includes Little Snitch and LuLu, interrupts you when an app makes a connection it has not seen before and asks you to allow or deny it. That gives you control over everything, and it means being asked questions about programs you have never heard of, often, especially in the first few days.
The quiet kind never asks. Radio Silence takes this approach with whole apps: you add an app to a list and it can no longer reach the internet. MiniFirewall takes it further by recording what everything connects to and letting you block an individual website without disabling the app it belongs to.
Which is right depends on one question: do you want to make a decision at the moment a connection happens, or look at what happened and decide afterwards?
Does turning on the built-in firewall still help?
Yes, and it works alongside a firewall app rather than competing with it. They cover different directions, so there is no conflict and no reason to choose. Switch the macOS one on for the incoming direction, and add an app for the outgoing direction if you want that half covered.
One practical note: a firewall app for the outgoing direction will need approval in System Settings the first time it runs, because macOS blocks that kind of system extension until you allow it by hand. That step looks alarming and is completely normal. Our setup guide walks through it with pictures of each screen.
Sources
- Apple, Block connections to your Mac with a firewall, on the scope of the built-in firewall
- Apple, NEFilterDataProvider, the system service firewall apps use for the outgoing direction