Your Mac ships with a built-in firewall, and on a fresh install it is turned off. macOS is safe out of the box because it doesn't run open network services by default, so most people never need to touch it. But if you use public Wi-Fi, share files, or just want the extra layer, turning the firewall on takes about thirty seconds. Here is exactly how, plus what each option actually does.
How to turn on the firewall (macOS Ventura, Sonoma, and later)
- Open the Apple menu → System Settings.
- Click Network in the sidebar, then Firewall.
- Toggle Firewall to On. That's it — the switch turns blue and the firewall is active immediately. No restart needed.
On older macOS (Monterey and earlier) the path is System Preferences → Security & Privacy → Firewall → Turn On Firewall. Apple renamed "System Preferences" to "System Settings" in Ventura, so if your menu still says the old name, use that route.
The firewall options, in plain English
Click Options… under the firewall toggle to see three settings that trip people up:
- Block all incoming connections. This is the strictest mode. It blocks everything except the bare essentials the system needs (like DHCP for getting an IP address). Turn this on when you're on untrusted public Wi-Fi — a coffee shop, an airport, a hotel. The trade-off: file sharing, screen sharing, and some apps that accept incoming connections will stop working until you turn it back off.
- Automatically allow built-in / downloaded signed software to receive incoming connections. Leave these on unless you know why you're changing them. They let Apple's own apps and properly-signed apps you installed accept connections without nagging you. Turn them off and you'll get a permission prompt for every app.
- Stealth mode. When on, your Mac ignores probe requests — it won't answer pings or port scans from unknown sources, so a stranger scanning the network can't even tell your Mac is there. Harmless to leave on, genuinely useful on public networks. This is the one option almost everyone should enable.
Per-app rules: allowing or blocking a specific app
You usually don't manage the Mac firewall app-by-app the way you would on Windows — macOS handles it automatically for signed apps. But when an app you trust tries to accept incoming connections, macOS pops up a dialog asking to "allow" or "deny." Your choice is remembered. To review or change those later, go back to Firewall → Options…; the app list there shows what you've allowed, and you can flip any entry between Allow incoming connections and Block incoming connections with the arrows next to it. Remove an entry with the minus button and you'll simply be asked again the next time that app needs access.
When do you actually need the firewall on?
Turn it on (with stealth mode) if you:
- regularly connect to public or shared Wi-Fi you don't control,
- run a Mac that hosts services other devices connect to, or
- simply want defense-in-depth and don't mind the occasional allow/deny prompt.
You can safely leave it off if your Mac only lives on your own home network behind a router (your router already has its own firewall doing most of this work). There's no downside to turning it on either way, so when in doubt, switch it on.
A firewall is NOT antivirus
This is the most common mix-up. A firewall controls what network connections are allowed in. Antivirus scans files for malicious code. They solve different problems, and turning on the firewall does nothing to stop malware you download and run yourself. The good news for Mac owners: macOS already includes silent, built-in malware protection (Gatekeeper and XProtect) that updates automatically, so most people don't need to buy third-party antivirus at all. We break that down in do Macs get viruses?
Frequently asked questions
Is the Mac firewall on by default?
No. macOS ships with the firewall turned off because the system doesn't expose open network services out of the box. You enable it manually in System Settings → Network → Firewall.
Does turning on the firewall slow down my Mac or internet?
No noticeable effect. The firewall only inspects incoming connection attempts; normal browsing, streaming, and downloads are outgoing and unaffected.
Should I turn on "block all incoming connections"?
Only situationally — it's great on untrusted public Wi-Fi, but it also breaks file sharing, AirDrop-adjacent features, screen sharing, and some apps. Most people leave it off and just enable stealth mode instead.
Do I need antivirus if the firewall is on?
They're separate tools. The firewall doesn't scan for malware. macOS's built-in Gatekeeper and XProtect already cover most people; see our full take on whether Macs need antivirus.
Shopping for a Mac and want to spend on the hardware, not on software you don't need? macOS's built-in security means you can skip the paid antivirus subscription entirely — put that money toward a better machine. Browse our Apple clearance deals on certified refurbished MacBooks, all covered by our own warranty.