Mac firewall: should it be on or off, and how to turn it on

MacUpdated 14 October 2026

Every Mac has a built-in firewall, and the UK's National Cyber Security Centre (NCSC) advises checking it's switched on. On a current Mac, turn it on in System Settings > Network > Firewall. Apple describes it in terms of unwanted connections from other computers. Malware is handled by separate macOS tools, and someone sitting at your keyboard is a different problem again.

Quick answer

On. Choose Apple menu > System Settings, click Network, then Firewall, and turn on Firewall. Apple says it can protect your Mac from unwanted contact initiated by other computers when you're connected to the internet or a network. Click Options to block all incoming connections, allow or block single apps, or turn on stealth mode.

Does a Mac have a firewall?

Yes. Apple's Platform Security guide says macOS includes a built-in firewall to protect the Mac from network access and denial-of-service attacks. It supports these configurations:

block all incoming connections, regardless of app
automatically allow built-in software to receive incoming connections
automatically allow downloaded and signed software to receive incoming connections
allow or deny access for apps you choose
stop the Mac responding to ICMP probing and port scan requests

Apple's Mac User Guide puts the switch in System Settings > Network > Firewall on macOS Ventura 13 and every version since, including the current macOS 27. On macOS Monterey 12 and earlier it was System Preferences > Security & Privacy > Firewall. Apple's Platform Security guide still names Privacy & Security for macOS 13 or later; the steps here follow the Mac User Guide.

Should the Mac firewall be on or off?

On, for most people. The NCSC's guide for small organisations says to check that your firewall is switched on in case a previous user has turned it off, and describes a firewall as blocking unwanted connections, usually from the internet, from reaching your device.

Apple's own description is similar: a firewall can protect your Mac from unwanted contact initiated by other computers when you're connected to the internet or a network.

The trade-off is that blocking can get in the way. Apple says blocking an app's access through the firewall could interfere with that app or other software that depends on it. If one app stops working, Options lets you allow that app on its own, so you don't have to switch the whole firewall off.

How do I turn on the firewall on a Mac?

It takes a few clicks in System Settings.

Choose Apple menu > System Settings.
Click Network in the sidebar, then click Firewall. You may need to scroll down.
Turn on Firewall.
To change how much it blocks, click Options, change the settings you want, then click OK.

Once it's on, Apple says that when your Mac detects an attempt to connect to an app you haven't added to the list, an alert asks whether to allow or deny the connection. Until you answer, the alert stays and connection attempts to that app are denied.

What do the Mac firewall settings do?

Click Options in Firewall settings to see them. Apple describes each one:

Block all incoming connections. Prevents incoming connections to non-essential services and apps. Apple separates out basic internet services, the apps that let your Mac find services provided by other computers on the network, and says this setting prevents connections to all other sharing services.
Automatically allow built-in software to receive incoming connections. Built-in apps and services signed by a valid certificate authority are added to the allowed list without asking you.
Automatically allow downloaded signed software to receive incoming connections. The same, for downloaded apps signed by a valid certificate authority.
Enable stealth mode. Covered below.
Add and Remove. Add an app or service to the list, then use its up and down arrows to allow or block connections through the firewall.

Apple adds an important note: certain apps that don't appear in the list may still have access through the firewall, including system apps, services and processes, and digitally signed apps opened automatically by other apps. To block access for these, add them to the list.

What is stealth mode on a Mac?

Stealth mode stops your Mac answering probes from other computers. Apple says it makes it more difficult for hackers and malware to find your Mac: with it on, the Mac doesn't respond to "ping" requests or to connection attempts from a closed TCP or UDP network. Apple adds that the Mac still answers requests from authorised apps.

Choose Apple menu > System Settings, click Network in the sidebar, then click Firewall.
If Firewall is off, turn it on first.
Click Options.
Turn on "Enable stealth mode", then click OK.

What doesn't the Mac firewall protect against?

Apple's firewall settings are about incoming connections. Apple is clear that some traffic gets through by design:

When you turn on a sharing service such as file sharing, Apple says macOS opens a specific port for that service.
An app or service on another system can request and be given access, or may have a trusted certificate and be allowed in.

So it's worth turning off sharing services you don't use. Apple says that for additional security you can prevent connections to these services by turning them off in Sharing settings: choose Apple menu > System Settings, click General, then Sharing.

The firewall also isn't how macOS deals with malware. Apple handles that with separate tools, XProtect, Gatekeeper and notarisation, which it describes in its guide to protecting against malware in macOS.

And none of Apple's firewall pages listed here describe it as protection against someone using your Mac in person. For that, Apple's Mac User Guide says you can keep your Mac secure by locking the screen: choose Apple menu > Lock Screen. Apple's keyboard shortcuts page adds Control-Command-Q. Lock it each time you step away.

Where Failshot fits

A firewall is about the network. Failshot is about the person at the keyboard. It doesn't filter connections, it isn't a firewall or antivirus, and it doesn't detect malware, spyware or remote access.

With Failshot on, it photographs whoever unlocks your Mac, then records a 5-second video. Video is on by default and can be switched off. Sound is off unless you turn it on, and the app warns you that recording someone's voice without their permission is against the law in some places.
Whoever unlocks sees Failshot's window saying the unlock was photographed, and when a video is recording. With the Mac's built-in camera, the green light comes on.
Email alerts and location are off until you turn them on. With alerts on, Failshot emails you about an unlock you don't confirm as yours, a wrong Failshot PIN or answer, or its camera access being switched off while it's on. Photos are kept on your Mac. They leave it only in email alerts and the encrypted web vault, if you turn those on, and, if you join your organisation with its invite code, encrypted for its security team too.
Switching Failshot off, or quitting it from its menu, takes Touch ID or your Failshot PIN and answer, never your Mac password. A wrong Failshot PIN or answer takes another photo. Like any Mac app, it can still be force-quit, and then it takes no photos until it's open again.

Failshot is out now for Mac, on macOS 14 or later, as a free download from failshot.app. Turning it on needs Failshot Pro, a paid subscription, and there's no free trial. Failshot Pro is £3.99 a month or £23.99 a year, VAT included, for as long as you stay subscribed, if you subscribe by 31 October 2026. From 1 November 2026 new subscriptions are £5.99 a month or £35.99 a year.

What it doesn't do: it doesn't photograph a wrong password at the login or lock screen, or the first login after a restart or a log out. Logging out, restarting or shutting down closes Failshot without asking for Touch ID or your Failshot PIN, and unless you've set it to start at login (Start Failshot at login is off until you turn it on in Settings), it stays off until you open it again. It watches only the Mac user account it runs in. It can't find a lost Mac on demand (an alert can say roughly where it was, if you turn location on), and it has no remote lock or wipe. It's for your own Mac. On a Mac your organisation owns or issues, use it only with the organisation's agreement: it must have agreed Failshot's Organisation Terms and told everyone who uses the Mac before Failshot is turned on. iPhone, Android and Windows versions are coming soon.

Questions people also ask

Is the Mac firewall on by default?

None of the Apple pages listed here says whether it's on by default, so check. The NCSC's advice for any device is to check the firewall is switched on in case a previous user turned it off. On a Mac, choose Apple menu > System Settings, click Network, then Firewall, and look at the Firewall switch.

Does the Mac firewall block outgoing connections?

Apple's Firewall settings describe blocking incoming connections: "Choose how much to block incoming connections". The Apple pages listed here don't describe filtering outgoing connections from your own apps.

Should I turn on stealth mode on my Mac?

Apple says stealth mode makes your Mac harder for hackers and malware to find, because it won't answer ping requests or connection attempts from a closed TCP or UDP network. Authorised apps still get answers. Turn it on under Firewall > Options.

Will the firewall stop file sharing?

Apple says certain shared services can connect through the firewall when they're turned on in Sharing settings, and that "Block all incoming connections" prevents connections to all sharing services other than basic internet services. To stop a service, turn it off in General > Sharing.

Do I still need antivirus if the firewall is on?

They do different jobs. The firewall handles incoming network connections. Apple's malware protection is XProtect, with Gatekeeper and notarisation checking apps before they open. Keep automatic security updates on so those stay current.