The Mac firewall: whether to turn it on and what changes
· 5 min read
macOS ships with a firewall that is off by default, which surprises people. Understanding why explains whether you need it.
What it actually does
The macOS application firewall blocks incoming connections to applications and services on your Mac. Something on the network tries to reach a service on your machine; the firewall decides whether to allow it.
It does not filter outgoing traffic. Applications on your Mac can connect out freely whether it is on or off.
That asymmetry is the whole thing. If your concern is “something on this network reaching my Mac”, the firewall helps. If your concern is “an application on my Mac sending data somewhere”, it does nothing.
Why it is off by default
Because a Mac with no sharing services enabled is not listening for much, so there is little to block. macOS does not run network services unless you turn them on.
The default posture is therefore reasonably safe without it, which is Apple’s reasoning. That does not make turning it on pointless.
Should you turn it on?
Yes on a laptop. It costs nothing and it matters on cafe, hotel, conference and airport networks where you have no idea who else is connected.
Yes on a desktop, unless you are running services you need reachable, in which case turn it on and allow those specifically.
The cost is essentially zero and the benefit is real when you join an untrusted network. There is little reason not to.
Turning it on
System Settings, Network, Firewall, then on.
Then Options, where the settings that matter live:
Block all incoming connections. Aggressive. It blocks everything except what is needed for basic network function, which also breaks file sharing, screen sharing, AirDrop in some cases, and printing to shared printers. Useful on a hostile network; annoying at home.
Automatically allow built-in software to receive incoming connections. Leave on.
Automatically allow downloaded signed software. Leave on for convenience, or turn off if you want to approve each application yourself. Turning it off means more prompts and more control.
Enable stealth mode. Makes the Mac not respond to pings and probes. Worth turning on for a laptop; it makes the machine less visible on a shared network. It does not make you invisible, and it reduces casual discovery.
For most people: firewall on, stealth mode on, the two automatic-allow options left on.
What it does not protect against
Worth being clear, because a firewall is often assumed to do more.
Nothing you initiate. Visiting a malicious site, downloading something harmful, entering credentials on a phishing page. All outgoing, all unaffected.
Malware already on the machine, which connects out.
Traffic interception between you and a site. That is what encryption handles.
Anything at the application level. It works on connections, not content.
So a firewall is one narrow layer. The things that actually catch Mac users are social. Does a Mac need antivirus covers where the real risk sits.
Turning off sharing matters more
If the firewall blocks incoming connections to services, the more direct step is not to run the services.
System Settings, General, Sharing. Turn off File Sharing, Screen Sharing, Remote Login, Printer Sharing and anything else you are not actively using.
On a laptop that joins networks you do not control, this is arguably more important than the firewall itself, and it is worth checking periodically because installers occasionally enable things. Setting up a Mac you will travel with covers the travel posture.
Outgoing firewalls
Third-party tools monitor and block outgoing connections, showing which application is contacting what.
Genuinely interesting, and useful if you want to know what your machine talks to. They also generate a great deal of prompting, and most people stop reading the prompts within a week, at which point the protection is theatre.
Worth it if you will engage with it. Not worth it as a set-and-forget layer.
Questions
Will the firewall slow my Mac or my internet? No measurably. It inspects connection attempts, not throughput.
Will it break anything? With the default options, rarely. “Block all incoming connections” does break sharing and printing, which is why it is not the default.
Do I need it if I am behind a router? A home router already blocks unsolicited incoming traffic from the internet. The firewall protects you from other devices on the same local network, which is the case that matters on public Wi-Fi.
How do I see what is listening?
sudo lsof -iTCP -sTCP:LISTEN -n -P
That lists processes accepting incoming connections. A short list is a good sign.