How to Block Internet Access for Any App on Mac

Can you block internet access for one app on Mac?

Yes. You can block new internet connections from one selected Mac app while keeping your browser and the rest of your Mac online. To do that, use an outgoing application firewall, add the app to its blocking list, enable protection, and reopen the app before testing.

Turning off Wi-Fi disconnects everything. A per-app internet blocker restricts the selected application instead.

The firewall built into macOS primarily controls incoming connections. Its “Block incoming connections” setting is not an equivalent per-app outgoing internet block. See Apple’s firewall documentation.

This guide uses NetBlocker. If you are choosing a Mac app firewall first, start with our comparison of Mac outbound firewalls, including dedicated comparisons with LuLu and Radio Silence. For specific examples, see how to block Microsoft Teams on a Mac or stop an app phoning home.

1. Install NetBlocker in Applications

Download the signed and notarized disk image, open it, and drag NetBlocker into Applications. Launch the copy in Applications, not a temporary copy or the app inside the disk image.

Follow the first-run tutorial to approve the network extension in System Settings and enable protection. The location of these settings can vary with macOS. Do not assume protection is active just because the main window has opened: check its status first.

2. Drop the app into NetBlocker

Find the app in Finder and drag it into the drop area. It appears in your saved list. With protection active, NetBlocker applies the rule to new connections from that app and confidently associated components.

Save your work, then quit and reopen the selected app before testing. Existing connections may behave differently from new ones; adding a rule is not proof that every already-open connection has ended.

3. Inspect related network processes

Apps can delegate work to bundled helpers, XPC services, or separate background processes. Expand the network-process row below an app to inspect components NetBlocker has discovered or observed.

Association matters: a generic name such as “node” or “python” alone does not prove a process belongs to the app you want to block. NetBlocker uses more specific identity and association information to avoid treating unrelated tools as the same helper.

Discovery is not a guarantee that every possible component is covered. A separately installed service may need its own rule. Do not block unfamiliar system services without understanding what depends on them.

4. Check the result, not just the saved rule

Confirm protection is on, then try a harmless action that requires a new online request in the selected app. Cached pages and downloaded content may still work offline and are not reliable tests.

Removing the rule allows future connections again while keeping the rest of your list. If an app behaves unexpectedly, save your work, remove its rule, and reopen it. Some apps do not handle failed network requests gracefully.

NetBlocker is not a VPN, malware scanner, or a simulation of switching off Wi-Fi. Localhost communication is intentionally preserved, and an app may react differently to blocked requests than to a disconnected network interface.

Know when protection is available

NetBlocker costs €4.99 for a lifetime license, with a 7-day trial and a 30-day money-back guarantee after purchase. It requires an Apple silicon Mac (M1 or newer) running macOS 13 Ventura or later. A paid license needs periodic online validation and has a 14-day offline allowance. After that allowance, or when the trial expires, protection turns off until access is restored through successful license validation or activation.