Guide

How to Block an App From Accessing the Internet on Mac

Use an outbound firewall to stop a Mac program connecting to the internet. LuLu is a free option for a whole program; FlowSense can block a classified service or hostname.

Facts checked on 3 November 2026.

Block a Program With LuLu

LuLu is free and open source. Its rules identify the program making an outgoing connection.

Install LuLu from Objective-See and follow its prompts to approve the system extension and network filter.
Open Rules › Show from its menu bar icon, then choose All or User rules.
Click Add Rule. Browse to the program, set the remote address and port to * for any destination, choose Block, then Add.
Test the app's online features. If a helper makes the connection, it may need its own rule.

To undo it, select the rule in LuLu's Rules window and delete it. Keep its default system rules. Objective-See notes that traffic outside macOS's network extension path cannot be blocked by LuLu.

Why the macOS Firewall Setting Doesn't Do This

System Settings › Network › Firewall controls incoming connections to your Mac. Blocking an app there does not stop that app initiating a connection to a website. Apple's firewall guide describes it as protection against contact started by other computers.

An outbound firewall makes a separate decision about connections started on your Mac. See how Mac outbound firewalls differ.

Block a Service or Hostname With FlowSense

If the problem is YouTube, an ad service or a particular server, a service rule can be narrower than disabling the browser. FlowSense's engine names services inside traffic without decrypting its contents. Watching that traffic is free, with an account; enforcing rules needs Full or the trial.

Open Live and find the service or hostname you want to stop.
Right-click its row and choose Block. Check which traffic the rule will match before confirming.
Try the service again, then check the rule and its hits in Policy.
Turn the rule off in Policy to undo it, or remove it.

A service such as YouTube is a traffic classification. An application such as Safari is the program that opened the connection. FlowSense currently matches the former in policy; it does not offer a rule to deny every connection from an arbitrary Mac executable. Use a program firewall when that is the requirement.

This bundled FlowRuby example blocks traffic identified as YouTube. It applies wherever the service is recognised, rather than only inside one browser. The FlowRuby tab shows the policy as code; use the rule controls to change it.

flowruby 1.1

# Check rules in order; stop at the first match.
policy_chain "main" do
  position 10
  mode :first_match
end

# Block a named app, rather than every connection.
policy "block-youtube" do
  chain :main, position: 10
  where { app == "YouTube" }
  action :drop
end

How classification works, FlowSense features and Free, trial and Full pricing.

What About the Hosts File and Screen Time?

The hosts file maps hostnames to IP addresses. It does not select the program making a request, and listing one hostname does not cover every subdomain or a connection made directly to an IP. It is a poor fit for "keep this app offline".

Screen Time manages app access and web content restrictions. Use it for limits on using an app or visiting websites. Those controls are different from leaving an app running while denying its network connections.

Check the Result

Test the actual task you wanted to stop: load a fresh page, start a sync or retry a transfer. Cached content can still appear while an app is offline. If you only need to make room for a video call, slowing the busy service may be enough.

Sources

LuLu belongs to Objective-See. FlowSense is not affiliated with it.