What the built-in firewall does
It blocks incoming connections to apps and services on your Mac, such as file sharing or a development server, unless you allow them. It's useful on public Wi-Fi. Turn it on in System Settings › Network › Firewall.
- Block all incoming connections allows only basic services like DHCP.
- Enable stealth mode stops your Mac answering pings and port scans.
- Automatically allow built-in software and signed apps to receive connections.
Check it from Terminal
/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstateControlling outgoing connections
macOS lets apps called content filters see and block outgoing connections. That's what Little Snitch, LuLu, Radio Silence, TripMode and Drippy use. Each needs your approval once in System Settings.
Drippy's firewall adds rules that depend on the network and your data plan, like blocking an app only on your hotspot. See how to block an app from the internet.
Questions
Should I turn on the Mac firewall?
Yes on public networks. It does no harm at home either, though most home routers already block incoming connections.
Is pf a firewall?
Yes. pf is the packet filter built into macOS. It can block outgoing traffic by address and port, but not by app.