AppPermitHow to block an app from accessing the internet on Mac
You want an app to stop talking to the internet — no uploads, no update nags, no telemetry. Most people head to System Settings › Network › Firewall first, and discover it does not control outbound traffic. Here are three approaches, from crude to reliable.
Why the built-in firewall is not enough
The macOS firewall filters inbound connections only (others connecting to your Mac). Connections an app opens itself — uploads, update checks, analytics — always pass, and there is no per-app outbound switch. Controlling outbound traffic requires a third-party firewall built on the Network Content Filter system extension.
Method 1: edit the hosts file (temporary, blunt)
Point the app’s domains at 127.0.0.1. Downsides: you must know every domain first, direct-IP or CDN changes defeat it, and it applies system-wide, affecting other apps.
Method 2: block the app with AppPermit
AppPermit is a local macOS firewall. Rules are enforced on your Mac by a system extension, per app, in real time.
- After installing, approve the system extension in System Settings when prompted (one time).
- Open the Apps list and find the app (search works).
- Set its network mode to No Network. It takes effect immediately: every outbound connection from that app is blocked and shows up in Activity.
Method 3: observe first, then decide
Not sure whether to block? Set the global mode to “Ask for New Addresses”: the first time an app reaches a new destination you get a prompt to allow once, always allow or block. Or change nothing yet and check Activity to see which addresses it connected to, which files it touched and which programs it launched — and ask the AI to explain a record you do not understand.
What happens to a blocked app
The app keeps running; its network requests simply fail, usually showing as “network error” or an endless spinner. AppPermit never quits or removes apps, and you can switch it back to “Follow Global” at any time.
FAQ
Does blocking an app affect system updates or other apps?
No. Rules apply per app and only affect the one you chose; the system and other apps are unaffected.
Does it work behind a proxy?
With a compatible local proxy core such as mihomo, AppPermit can attribute connections to their source apps and enforce blocking rules. Setup is required, and some advanced modes have limitations.
How much does AppPermit cost?
A 7-day full trial after install, then $14.99 per year (one-time annual pass) or $29.99 lifetime. It is not an auto-renewing subscription.
7-day full trial · $14.99/yr or $29.99 lifetime · macOS 14+