Block an app from the internet on a Mac

Why the built-in firewall doesn't help

System Settings › Network › Firewall decides whether other computers can connect to apps on your Mac. It doesn't stop an app on your Mac from connecting out, which is what you want when an app phones home or burns through hotspot data.

Option 1: change the app's own settings

Many apps can turn off automatic updates, sync, crash reports and analytics in their settings. It's the safest first step, because the app knows it's offline and won't keep retrying.

Option 2: pf in Terminal

macOS includes pf, the packet filter. It blocks by address and port, not by app, so it suits a known server rather than a whole app. Rules are lost at restart unless you add them to /etc/pf.conf.

echo 'block drop out quick to 203.0.113.10' | sudo pfctl -ef -

sudo pfctl -d

Replace 203.0.113.10 with the server's address. This replaces the running pf rules until you restart. The second command turns pf off again.

Option 3: a firewall app

An outgoing firewall sees which app opens each connection and can block it. In Drippy, open Apps and turn off the app's switch. You can also block it only on your hotspot, only after it has used a set amount today, or for an hour. See Drippy's firewall.

Other options are Little Snitch, LuLu and Radio Silence. See the best firewall apps for Mac.