Prevent Apps From Accessing Internet on Mac

This guide shows you how to stop individual apps on your Mac from connecting to the internet, using the built-in macOS firewall. This is useful for blocking telemetry, preventing automatic updates, or keeping a specific app offline while still using it locally. You’ll need an admin account and, optionally, a free app called Little Snitch if you want more granular control.

What You’ll Need

An administrator account on your Mac
macOS Ventura or later (for the exact steps below; older versions are similar)
Optional: A third-party firewall app like Little Snitch or LuLu for per-app rules

Step-by-Step

Open System Settings. Click the Apple menu () in the top-left corner and select System Settings (or System Preferences on older macOS).
Go to Network. In the sidebar, click Network. Then, on the right side, click Firewall.
Turn on the firewall. If the firewall is off, click the toggle to turn it on. You may need to enter your admin password.
Click “Options…”. This opens the firewall settings where you can manage app rules.
Add an app. Click the + button. A file browser opens—navigate to the app you want to block. Applications are usually in the Applications folder. Select the app and click Add.
Block incoming connections. After adding, the app appears in the list. Next to it, click the dropdown menu (currently “Allow incoming connections”) and select Block incoming connections.
Done. The app will now be blocked from receiving any incoming network connections. Note: this does not stop the app from making outgoing connections (e.g., sending data).

For outgoing connections (most common need): The built-in firewall only blocks incoming traffic. To block an app from making outgoing connections, you need a third-party tool. Here’s how with a free app like LuLu:

Download and install LuLu from its official website (or use Little Snitch, a paid alternative).
Launch LuLu. It will ask for permission to install a system extension—allow it and restart if prompted.
When an app tries to connect, LuLu will show a popup. Choose “Block” for that app, or go to LuLu’s preferences to add a rule manually.
To add a rule manually: Open LuLu, click the “+” button, select the app, and set the action to “Block”. You can also specify the direction (outgoing) and protocol.

Common Mistakes

Confusing incoming and outgoing. The built-in firewall blocks only incoming connections. If you want to stop an app from sending data out, you need a third-party tool.
Blocking the wrong process. Some apps have helper processes (e.g., “Spotlight” or “Crash Reporter”). Blocking the main app might not stop the helper. Check Activity Monitor to see which process is connecting.
Not restarting the app. After changing firewall rules, quit and reopen the app for the change to take effect.
Forgetting to turn on the firewall. If the firewall is off, your rules do nothing.

Tips

Use the built-in firewall for quick, free blocking of incoming connections. For most users, this is enough to stop unsolicited access.
For outgoing blocking, LuLu is free and open-source. Little Snitch is more advanced but paid. Both let you create rules per app.
If you only want to block an app temporarily, you can turn off the rule later by switching the dropdown back to “Allow”.
Check the “Automatically allow signed software to receive incoming connections” option—if it’s checked, some apps might bypass your rules. Uncheck it for stricter control.

Troubleshooting

App still connects after blocking. First, ensure you blocked the correct app. Use Activity Monitor to see the app’s network activity. If it’s still connecting, it might be a helper process—block that too. Also, restart the app.

Firewall options are grayed out. You need admin privileges. Click the lock icon and enter your password, or make sure you’re logged in as an admin.

Can’t find the app in the file browser. Some apps are inside other folders (e.g., inside a .app bundle). Use Finder to locate the actual .app file. For example, for an app in /Applications, it’s usually at /Applications/AppName.app.

After using LuLu, the app still connects. Check LuLu’s rules—maybe the rule is set to “Allow” or “Ask”. Also, ensure LuLu is running (check the menu bar icon). If it’s not, the rules aren’t enforced.

Blocking a system app breaks something. If you block a system process like “configd” or “mDNSResponder”, you might lose network connectivity or other features. Only block apps you know.

Frequently Asked Questions

Does the built-in Mac firewall block outgoing connections?

No. The built-in firewall only blocks incoming connections. To block outgoing, use a third-party app like LuLu or Little Snitch.

How do I block an app from using the internet without a third-party app?

You can’t fully block outgoing connections without a third-party tool. The built-in firewall can only block incoming. For outgoing, you need a firewall app that supports outbound rules.

Will blocking an app’s internet access affect its performance?

Usually not. The app will run locally, but features that require internet (like updates, cloud sync, or online content) will not work. It might crash if it expects a network connection.

Can I block a specific website for an app, not all internet?

Yes, with a third-party firewall like Little Snitch, you can create rules based on domain or IP. The built-in firewall only allows all-or-nothing per app.

Is it safe to block system apps?

It can be risky. System apps like “nsurlsessiond” are used for many things. Blocking them might cause errors. Only block apps you know are unnecessary.

How do I unblock an app later?

Go back to System Settings > Network > Firewall > Options, find the app, and change the dropdown back to “Allow”. For third-party tools, remove or edit the rule.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →