Local network

The macOS firewall blocks incoming connections

The macOS firewall controls connections that other computers start to your Mac. It does not control connections that your apps start.

Applies to: macOS 13 Ventura and later for System Settings > Network > Firewall. Earlier versions use Security & Privacy.Checked: 29 October 2026

Symptoms

Other devices cannot connect to a server, game or sharing service on your Mac.
The Mac does not answer ping from another device.
A dev server works on the Mac but not from your phone on the same Wi-Fi.
macOS asks whether an app can accept incoming network connections.

Likely causes

Block all incoming connections. Apple says that this option blocks connections to nonessential services and to all other sharing services.
A denied app. You clicked Deny at an earlier prompt, or the app is set to block in Firewall Options.
Stealth mode. The Mac does not answer probe requests such as ping.
The server listens on 127.0.0.1. Then only the Mac can connect, whatever the firewall setting.

How to check

Choose Apple menu > System Settings > Network > Firewall. See whether Firewall is on.
Click Options. Look at the setting for your app and at Block all incoming connections.

Show the firewall state from Terminal.

/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
/usr/libexec/ApplicationFirewall/socketfilterfw --getblockall
/usr/libexec/ApplicationFirewall/socketfilterfw --getstealthmode

Make sure that the server listens on all addresses, not 127.0.0.1 only.
```
lsof -nP -iTCP:8000 -sTCP:LISTEN
```

How to fix it

In Firewall Options, turn off Block all incoming connections if you need sharing or servers.
Click the Add button and select the app. Set it to allow incoming connections.
Click OK. Test the connection from the other device again.
You can also allow an app from Terminal. Replace the path with your app.
```
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --unblockapp /Applications/Example.app
```
Needs an administrator password.
Keep the firewall on. Allow only the apps that must accept connections.

With Kilobat

Kilobat's filter controls the connections that your apps start. It does not replace the macOS firewall for incoming connections.
To see the open sockets of a server process, use the destinations command.
```
kilobat destinations --pid 12345
```

Questions

Does the macOS firewall block outgoing connections?

No. Apple describes it as protection from connections that other computers start. Use a filter app for outgoing connections.

What does stealth mode do?

The Mac does not answer probe requests such as ping from unknown sources. Allowed apps still get their requests.

Sources

Apple Support: Change Firewall settings on Mac
Apple Support: Block connections to your Mac with a firewall
Apple Platform Security: Application Firewall
socketfilterfw(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with man <name> in Terminal.