Updates and downloads
gs.apple.com
gs.apple.com is an Apple host that devices need during setup, and when they install, update or restore the operating system. Apple lists it for every platform.
Short answer
An Apple host that devices need during setup and for operating system updates. Apple lists it in both sections of its host list.
Don’t block
Don't block it. Apple lists it for setup and for operating system updates, so updates and restores can fail.
- Matches
gs.apple.com
A name with *. covers every name under it: *.push.apple.com matches 1-courier.push.apple.com.
What it serves
Apple's enterprise host list names gs.apple.com in its Device setup section, on port 443. That section covers setup and installing, updating or restoring the operating system.
It also lists the host in its Software updates section, for iOS, iPadOS, tvOS, watchOS and macOS updates, on ports 443 and 80.
Apple Platform Security says that every update needs a network connection to Apple's installation authorization server, which signs the update for each device. Apple doesn't say which host that is.
Processes that use it
What breaks if you block it
Don’t block
Don't block it. Apple lists it for setup and for operating system updates, so updates and restores can fail.
What breaks if you block it
- macOS updates may fail to install.
- Setting up or restoring a device may fail.
With Kilobat Pro and the network filter, you can block a host for every app or for one app: in Connections, select a connection and choose Block. Apple’s own services are never blocked by Kilobat’s Protection lists.
Notes
Apple says that devices with Apple silicon always need a connection to Apple to update, because each update is personalized.
Apple’s rules for its hosts
Apple’s list, Use Apple products on enterprise networks, says that devices open these connections, not Apple’s servers. Apple services fail any connection that uses HTTPS interception, so a proxy that inspects TLS should leave Apple’s hosts alone.
If a firewall allows hosts by name, allowing *.apple.com covers most Apple services, Apple says. A firewall that works only with addresses can allow 17.0.0.0/8 for IPv4, and 2403:300::/32, 2620:149::/32 and 2a01:b740::/32 for IPv6.
To see which app on your Mac opened a connection to this host, use Kilobat’s Connections tab, or the agent network log for AI agents.
Sources
- Apple Support: Use Apple products on enterprise networks
- Apple Platform Security: Secure software updates
Checked on 1 November 2026.