Step by step
How to block an app from accessing the internet on Mac
To stop a Mac app connecting out, use an outbound application firewall. The built-in macOS firewall controls incoming connections; its app list is not an outbound block list.
Know what connects
Guides
Understand your Mac’s connections. Make a rule. Fix a problem. Keep a way back.
Reference
Does the macOS firewall block outgoing connections?
No. The macOS Firewall settings control incoming connections. They do not provide a per-app outbound destination allowlist.
Step by step
No internet after a macOS update? Turn the filter off first
If your Mac loses connectivity after a macOS update, temporarily disabling a third-party network filter can help isolate the cause. Restore a working connection before changing rules or reinstalling software.
Step by step
How to stop Mac apps phoning home
To limit an app’s outgoing connections, identify its destinations and block only the ones you intend to deny. A hostname alone does not prove a connection contains analytics.
Step by step
Fewer firewall alerts
Reduce firewall alerts by choosing the right mode and rule scope. Do not solve alert fatigue by approving destinations you have not understood.
Step by step
Using a Mac firewall with a VPN or Private Relay
Test a firewall with the VPN and Private Relay configuration you actually use. Outbound has no published compatibility result for these combinations yet.
Step by step
Fix a network extension that will not run
An approved network extension and an enabled content filter are separate parts of setup. Check both before assuming a rule is broken.
Step by step
Back up and move your firewall rules
Export Outbound’s rule store before moving Macs or making major changes. Import replaces your user rules; it keeps managed, blocklist and rule-group rules already in the store.
Step by step
See which apps use the internet on your Mac
Activity Monitor shows network usage by process. For destination details and allow/deny decisions, use a connection monitor such as Outbound’s.
Step by step
Deploy Outbound with MDM
Deploy Outbound’s system-extension and content-filter profiles before the app requests activation. Use a pilot Mac and user-approved device-channel MDM enrollment.
Step by step
Send Outbound audit logs to a SIEM
Outbound exports local JSON Lines audit files to a folder your SIEM collector can read. It does not send events directly to a SIEM API.
Reference
outboundctl reference
outboundctl is Outbound’s command-line interface for rules, profiles, blocklists, audit export and managed feed validation. It edits the local store; it does not connect directly to the filter extension.
Step by step
Mac firewall settings: incoming connections and options
Mac firewall settings are in System Settings → Network → Firewall. Turn it on to control incoming connections, then use Options to choose which apps may receive them. These settings do not block outgoing connections.
Step by step
Which hosts your coding agents contact
Coding agents are apps. Outbound lists Claude Code, Codex and Grok CLI under their own names, even when the executable is a versioned path or a bundled Node. This page shows destinations from one capture, the opt-outs the vendors document, and how to limit one host.
Step by step
An outbound firewall workflow for developers
Package managers, test runners and dev servers can share one node or python3 binary. A rule on that exact file covers every program that runs as that file. Scope the rule by host when you want the registry, not every other destination that binary can open.
Step by step
The name on the row is the daemon
nsurlsessiond and cloudd are macOS daemons. A firewall row names the process that owns the connection. nsurlsessiond performs tasks for background-configured NSURLSessions. cloudd is the daemon backing CloudKit. The app that asked for the work can go by a different name.