---
title: "macOS firewall blocks incoming connections: allow an app · Kilobat Guides"
url: "https://kilobat.app/guides/macos-firewall-incoming"
description: "The macOS firewall controls incoming connections only. Find out if it blocks your server or sharing service, and allow the app safely."
---

Local network

# The macOS firewall blocks incoming connections

The macOS firewall controls connections that other computers start to your Mac. It does not control connections that your apps start.

Applies to: macOS 13 Ventura and later for System Settings > Network > Firewall. Earlier versions use Security & Privacy. · Checked: 29 October 2026

## Symptoms

- Other devices cannot connect to a server, game or sharing service on your Mac.
- The Mac does not answer ping from another device.
- A dev server works on the Mac but not from your phone on the same Wi-Fi.
- macOS asks whether an app can accept incoming network connections.

## Likely causes

- **Block all incoming connections.** Apple says that this option blocks connections to nonessential services and to all other sharing services.
- **A denied app.** You clicked Deny at an earlier prompt, or the app is set to block in Firewall Options.
- **Stealth mode.** The Mac does not answer probe requests such as ping.
- **The server listens on 127.0.0.1.** Then only the Mac can connect, whatever the firewall setting.

## How to check

1. Choose Apple menu > System Settings > Network > Firewall. See whether Firewall is on.
2. Click Options. Look at the setting for your app and at Block all incoming connections.
3. Show the firewall state from Terminal.

   ```
   /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
   /usr/libexec/ApplicationFirewall/socketfilterfw --getblockall
   /usr/libexec/ApplicationFirewall/socketfilterfw --getstealthmode
   ```
4. Make sure that the server listens on all addresses, not 127.0.0.1 only.

   ```
   lsof -nP -iTCP:8000 -sTCP:LISTEN
   ```

## How to fix it

1. In Firewall Options, turn off Block all incoming connections if you need sharing or servers.
2. Click the Add button and select the app. Set it to allow incoming connections.
3. Click OK. Test the connection from the other device again.
4. You can also allow an app from Terminal. Replace the path with your app.

   ```
   sudo /usr/libexec/ApplicationFirewall/socketfilterfw --unblockapp /Applications/Example.app
   ```

   Needs an administrator password.
5. Keep the firewall on. Allow only the apps that must accept connections.

## With Kilobat

1. Kilobat's filter controls the connections that your apps start. It does not replace the macOS firewall for incoming connections.
2. To see the open sockets of a server process, use the destinations command.

   ```
   kilobat destinations --pid 12345
   ```

## Questions

**Does the macOS firewall block outgoing connections?**

No. Apple describes it as protection from connections that other computers start. Use a filter app for outgoing connections.

**What does stealth mode do?**

The Mac does not answer probe requests such as ping from unknown sources. Allowed apps still get their requests.

## Sources

- [Apple Support: Change Firewall settings on Mac](https://support.apple.com/guide/mac-help/change-firewall-preferences-on-mac-mh11783/mac)
- [Apple Support: Block connections to your Mac with a firewall](https://support.apple.com/guide/mac-help/block-connections-to-your-mac-with-a-firewall-mh34041/mac)
- [Apple Platform Security: Application Firewall](https://support.apple.com/guide/security/application-firewall-seca0e83763f/web)
- socketfilterfw(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

## Related guides

- [An app cannot find devices on the local network](https://kilobat.app/guides/local-network-permission): macOS 15 Sequoia and later ask before an app connects to devices on your local network.
- [A container cannot reach localhost on the Mac](https://kilobat.app/guides/localhost-from-container): Each container has its own network stack.
- [Little Snitch, LuLu and other network extensions conflict on a Mac](https://kilobat.app/guides/network-extension-conflicts): Firewalls, VPNs and content filters on macOS use network extensions.
- [Find the devices on your local network from a Mac](https://kilobat.app/guides/find-devices-on-network): macOS has two built-in ways to see other devices: the ARP table and Bonjour.