Sending or Receiving: Which Direction Should You Block?
Direction is about who starts the conversation, not which way data travels. An outgoing connection is your Mac reaching out to something. An incoming connection is something reaching towards your Mac. Once either is open, information moves both ways, which is why the question confuses people the first time they meet it.
If you are unsure, both directions is the safe answer and is almost always what you want.
Why does data go both ways in an “outgoing” connection?
Because a connection is a conversation, not a delivery. When your browser loads a page, your Mac starts the connection by asking for it, and the page comes back down the same connection. That is an outgoing connection carrying almost entirely incoming data.
The label describes who knocked, and firewalls use it because that is the part they can control. Once a conversation is open, blocking half of it is meaningless; you can only decide whether it opens at all.
When should I block outgoing connections?
Almost always, if what bothers you is something on your Mac talking to the outside world. That covers essentially all the reasons people install a firewall:
- An app reporting what you do to an analytics company
- Software checking in with its maker when you did not ask it to
- A browser extension contacting a server you do not recognise
- Adverts and trackers loading inside apps and pages
All of these are your Mac starting the conversation, so blocking outgoing connections stops them.
When should I block incoming connections?
When something on the network is reaching towards your Mac and you would rather it did not. This is a narrower set of cases and mostly applies if you run something that listens:
- File sharing, screen sharing, or printer sharing left switched on
- A web server or development server running locally
- Any program that accepts connections from elsewhere on the network
The firewall built into macOS already covers this direction, and switching it on in System Settings, Network, Firewall is a sensible default. A firewall app adds finer control, per app rather than for the whole Mac.
When should I block both?
When you want the thing gone and do not want to think about it further. Blocking both directions means no new connection can start in either direction, which is the complete answer.
This is the right default for two situations in particular. First, a website or address you have decided you want nothing to do with. Second, any case where you are not sure which direction applies, because guessing wrong leaves the thing you objected to still working.
A worked example: a media player showing adverts
The player contacts an advertising network. Your Mac is starting that connection, so outgoing is the direction that stops it.
But consider what you are actually blocking. If you block the app, you lose the player. If you block the advertising network for every app on the Mac, the player keeps working, and every other app stops reaching that network too. The second is almost always better, and the direction for it is outgoing, or both if you want to be thorough.
A worked example: a local development server
You run a web server on your Mac while working, and you do not want anyone else on the cafe network reaching it.
Here the other machine starts the connection, so incoming is the direction. Blocking outgoing would achieve nothing, since your server is not the one reaching out.
Does blocking one direction ever break something subtly?
Yes, and it is worth knowing the pattern. An app that can start connections but cannot receive them will often appear to work and then fail at some specific task, such as a file transfer or a call connecting.
This is the main argument for choosing both directions when you are unsure. A block that fails completely is easy to diagnose. A block that half works produces a mystery.
What about the direction of the data itself?
Some tools do talk about the volume of data going up and down, which is a different measurement and a different question. That is about how much, not about who is allowed to talk to whom.
A firewall answers the second question. If what you want is a chart of how much data went where, that is a bandwidth monitor, and it is a separate kind of tool.
Sources
- Apple, Block connections to your Mac with a firewall, on the incoming direction in macOS
- Apple, NEFilterDataProvider, on how firewall apps see the direction of a connection