Every Mac ships with a built-in firewall — but unlike most built-in protections, it is switched off by default. Apple reasons that macOS services are already cautious, yet on shared or public networks, enabling the firewall adds a sensible extra wall between your Mac and everything else trying to reach it. This guide shows how to turn it on, what its options mean, how to allow the apps you trust, and the one setting (“block all incoming connections”) that will break AirDrop and file sharing if you enable it carelessly.
Quick Answer
Open System Settings, go to Network, then Firewall, and switch the firewall on. Then click Options and confirm that “Automatically allow built-in software” and “Automatically allow downloaded signed software” are on, so normal apps keep working. Leave “Block all incoming connections” off unless you specifically need maximum lockdown, because it stops AirDrop, file sharing, and screen sharing from receiving anything.
What the macOS Firewall Does (and Does Not Do)
The built-in firewall is an application firewall that controls incoming connections — other computers and devices trying to reach services on your Mac:
- It lets you decide, app by app, whether a program may accept incoming connections.
- It quietly ignores unsolicited probes from the network, especially in stealth mode.
- It does not filter outgoing traffic — apps phoning home are not blocked by it (that needs third-party tools).
- It is not antivirus software. It complements, rather than replaces, keeping macOS updated and being careful with downloads.
- Your router already provides a basic network barrier at home; the Mac firewall matters most on café, hotel, campus, and office networks where neighbouring devices are strangers.
Step by Step: Turn On the Firewall
- Open System Settings from the Apple menu.
- Click Network in the sidebar.
- Click Firewall.
- Switch the Firewall toggle on. (On older macOS: System Preferences, Security & Privacy, Firewall tab, click the lock, then Turn On Firewall.)
- Click Options (or Advanced) to review the rules described next — the defaults are right for most people.
The change takes effect immediately; there is nothing to restart. Apple’s firewall guide on Apple Support documents each option officially.
Understanding the Firewall Options
Block all incoming connections
The nuclear option. With it on, only the most basic system services (like the ones that keep the network itself alive) can receive traffic. AirDrop receiving, file and screen sharing, printer sharing, and game or app servers on your Mac all stop working inbound. Use it temporarily on hostile networks if you like, but leave it off at home or you will create exactly the “why did AirDrop break” mystery our fix guides describe.
Automatically allow built-in software to receive incoming connections
Leave this on. Apple’s own services (sharing, AirDrop infrastructure, and similar) are signed and trusted; this setting lets them work without prompts.
Automatically allow downloaded signed software
Also leave this on for a quiet life. Legitimate apps signed by identified developers get permission automatically; unsigned software still triggers a prompt asking you to allow or deny.
Enable stealth mode
A good optional extra. Stealth mode makes the Mac ignore ping and probe attempts — network scanners see silence rather than a machine politely declining. It does not affect your normal browsing or apps. Turn it on if you regularly use public Wi-Fi.
The app list
The list shows every app that has requested incoming access, with Allow or Block beside each. You can add apps manually with the + button. If something network-related misbehaves after enabling the firewall, this list is the first place to look — the app may simply be set to Block.
Allowing or Blocking a Specific App
- In Firewall Options, look for the app in the list.
- Click its setting and choose Allow incoming connections or Block incoming connections.
- If the app is missing, click +, find it in the Applications folder, and add it — it is added with Allow by default; adjust if needed.
- Close settings; changes apply instantly.
Typical apps that legitimately need incoming access: file and screen sharing, media servers, some games, remote-desktop tools, and local web development servers. If you do not recognise an app in the list, block it and see if anything you use breaks — you can always flip it back. Pairing the firewall with disk encryption gives a solid baseline; see our guide on enabling FileVault on a Mac for the other half.
Testing That Everything Still Works
After enabling the firewall, spend two minutes confirming your normal tools survived:
- Send a file to the Mac by AirDrop from your phone.
- If you use file sharing or screen sharing between your own devices, connect once.
- Print to a shared printer if your Mac hosts one.
- Join a video call (incoming media in calls is usually handled by the app’s own allowances).
Anything that fails will almost always be fixed by switching that one app to Allow in the firewall list — no need to disable the whole firewall.
Firewall on a Mac That Shares Files or Runs Servers
If your Mac shares folders, its screen, or media with the household, or runs any kind of local server (a development site, a game server for friends), the firewall needs a touch more thought. macOS lists its own sharing services in the app list automatically when they are enabled, and the “automatically allow built-in software” setting covers them — but the moment you enable “block all incoming connections,” those shares quietly stop being reachable until you turn it off again. Third-party servers are added per app with the + button, as described earlier. Rule of thumb for a sharing Mac: firewall on, block-all off, stealth optional, and test each share once after any change so a silent block does not surprise the family later.
Common Mistakes and Helpful Tips
- Enabling “Block all incoming connections” and forgetting. Weeks later AirDrop and sharing mysteriously fail. If those features break after a security tidy-up, check this switch first.
- Assuming the firewall is already on. It is off by default on new Macs. Check, do not assume.
- Turning the firewall off to fix one app. A sledgehammer solution — set that single app to Allow instead and keep the protection.
- Expecting it to stop outgoing leaks. The built-in firewall governs incoming connections only. For outgoing control you would need third-party software; for most home users, that is optional.
- Ignoring prompts. When macOS asks whether an app may accept incoming connections, decide deliberately — Allow for tools you know and trust, Deny for anything unexpected. The choice is remembered in the app list.
Conclusion
Turning on the macOS firewall takes less than a minute: Network, Firewall, on — then leave the two “automatically allow” options enabled, consider stealth mode, and resist the “block all” switch unless you truly need it. The result is a Mac that stops answering strangers on public networks while your AirDrop, sharing, and apps keep working as normal. It is one of the cheapest security wins available on the platform.
Frequently Asked Questions
Why is the Mac firewall off by default?
Apple ships it off because macOS does not listen on many open services by default and signed apps prompt for access anyway. Turning it on is still recommended, especially for laptops that use public networks.
Will the firewall slow down my internet?
No. It judges connection attempts, not data throughput. Downloads, streaming, and browsing run at full speed with the firewall on.
Does the firewall protect me on public Wi-Fi?
It helps by blocking unsolicited incoming connections from other devices on that network. Combine it with stealth mode, a VPN for sensitive work, and keeping sharing services off in public for proper defence in depth.
What is stealth mode exactly?
Stealth mode stops the Mac from responding to ping and port probes, making it effectively invisible to casual network scans. It does not hide your traffic or act like a VPN — it simply makes the Mac silent when strangers come knocking.
Can I see which apps the firewall has blocked?
Yes. The app list in Firewall Options shows every app with an incoming-connections rule and whether it is set to Allow or Block. Adjust any entry there; changes take effect immediately.
Leave a Reply