How to block internet access for a Mac app

Keep your Mac online. Choose which app cannot connect.

Turning off Wi-Fi disconnects everything. An outgoing application firewall lets you keep your browser and other tools online while restricting a selected app.

The firewall built into macOS primarily controls incoming connections. Its “Block incoming connections” setting is not an equivalent per-app outgoing internet block. See Apple’s firewall documentation.

This guide uses NetBlocker. If you are choosing a tool first, our comparisons with LuLu and Radio Silence explain the trade-offs.

1. Install NetBlocker in Applications

Download the signed and notarized disk image, open it, and drag NetBlocker into Applications. Launch the copy in Applications, not a temporary copy or the app inside the disk image.

Follow the first-run tutorial to approve the network extension in System Settings and enable protection. The location of these settings can vary with macOS. Do not assume protection is active just because the main window has opened: check its status first.

2. Drop the app into NetBlocker

Find the app in Finder and drag it into the drop area. It appears in your saved list. With protection active, NetBlocker applies the rule to new connections from that app and confidently associated components.

Save your work, then quit and reopen the selected app before testing. Existing connections may behave differently from new ones; adding a rule is not proof that every already-open connection has ended.

3. Inspect related network processes

Apps can delegate work to bundled helpers, XPC services, or separate background processes. Expand the network-process row below an app to inspect components NetBlocker has discovered or observed.

Association matters: a generic name such as “node” or “python” alone does not prove a process belongs to the app you want to block. NetBlocker uses more specific identity and association information to avoid treating unrelated tools as the same helper.

Discovery is not a guarantee that every possible component is covered. A separately installed service may need its own rule. Do not block unfamiliar system services without understanding what depends on them.

4. Check the result, not just the saved rule

Confirm protection is on, then try a harmless action that requires a new online request in the selected app. Cached pages and downloaded content may still work offline and are not reliable tests.

Removing the rule allows future connections again while keeping the rest of your list. If an app behaves unexpectedly, save your work, remove its rule, and reopen it. Some apps do not handle failed network requests gracefully.

NetBlocker is not a VPN, malware scanner, or a simulation of switching off Wi-Fi. Localhost communication is intentionally preserved, and an app may react differently to blocked requests than to a disconnected network interface.

Know when protection is available

NetBlocker costs €4.99 for a lifetime license, with a 7-day trial. It requires an Apple silicon Mac (M1 or newer) running macOS 13 Ventura or later. A paid license needs periodic online validation and has a 14-day offline allowance. After that allowance, or when the trial expires, protection turns off until access is restored through successful license validation or activation.