Does macOS Have an Outbound Firewall?
The Firewall switch in System Settings protects incoming access. To control connections your apps start, use an outbound firewall and choose whether to match the program or the service it contacts.
Facts checked on 3 November 2026.
Incoming and Outgoing Are Different Decisions
An incoming connection begins elsewhere: another computer tries to reach a server or sharing service on your Mac. An outgoing connection begins on your Mac: a browser opens a website, a sync app uploads a file, or a program checks for updates.
Apple's built-in application firewall, under System Settings › Network › Firewall, handles the first case. Its per-app access list is not a list of apps allowed to browse the internet.
macOS also has lower-level packet filtering tools. Configuring those is different from getting a per-program prompt or a service name you can act on. For everyday outgoing controls, a dedicated app supplies the rules and interface.
Choose What You Want to Match
| Your Goal | Useful Match | Option |
|---|---|---|
| Keep a Mac Program Offline | The executable making the connection | LuLu or Little Snitch |
| Stop a Named Service Across Traffic | The classified service, such as YouTube | FlowSense |
| Stop Contact With One Server | A hostname or destination address | A destination rule in your firewall |
| Let a Transfer Continue More Slowly | A service rule linked to a speed limit | FlowSense |
LuLu is a free, open-source starting point for outgoing program rules. Little Snitch is another option when you want program prompts and network monitoring.
FlowSense combines a view of connections with service, hostname and category rules. It shows which Mac application owns traffic, but its policy currently does not match that application identity. A service rule can affect traffic from several programs. The blocking guide walks through both approaches.
Block Telemetry With a Narrow Rule
First identify what is connecting in Live. A hostname alone is not evidence that a connection is unwanted: update checks, crash reports and account sign-in can share infrastructure.
- Choose a service or hostname you have identified, then use Block from its Live row.
- Review the scope, try the rule temporarily and test the app's normal tasks.
- If something breaks, turn the rule off in Policy and check again.
For lists of known destinations, FlowSense fetches lists such as EasyPrivacy daily from their publishers. A list supplies the names; a rule decides what happens to matching traffic. Review the classifier and rule together in Policy. Adding a list alone is not a promise that every tracker has been blocked.
Keep Essential Services Working
Avoid broad rules against DNS, Apple software updates or iCloud while you are learning what the traffic does. DNS failures can look like an internet outage; an overbroad cloud rule can interrupt sync or sign-in.
FlowSense's Warden excludes Apple updates, iCloud, DNS, macOS and FlowSense from its own actions. That protection describes Warden's decisions, not a guarantee about every rule you write yourself. Start in Ask mode and review its suggestions.
Start by Watching
You can inspect Live and Today's traffic with FlowSense Free. Full adds rules, speed limits and Warden. Read how the engine identifies services, what each feature does and which plan includes it before choosing.
Sources
- Block connections to your Mac with a firewall (Apple)
- LuLu (Objective-See)
- Little Snitch (Objective Development)
LuLu belongs to Objective-See. Little Snitch is a trademark of Objective Development Software GmbH. FlowSense is not affiliated with either.