Little Snitch can block internet traffic of a particular app. Can I do something similar without (paying) Little Snitch, either by using free alternatives or configuring the OS X firewall directly?

  • 9
    Little Snitch is completely worth the price. Buy it. You will thank me.
    – Josh
    Commented Jun 20, 2013 at 18:44

6 Answers 6



TCPBlock is a lightweight and fast application firewall … you can prevent selected applications on your computer from opening connections to the network.

TCPBlock is free and can be downloaded from MacUpdate, however TCPBlock doesn't appear to work with El Capitan and is no longer being updated.

PF Firewall

OS X comes with the PF firewall, which can be configured to block all connections to certain servers in all apps. Blocking all connections from a single app is not possible as far as I am aware without external software.

You can use IceFloor as a GUI for the PF firewall.

IceFloor Black List

  • 2
    Can you really block apps from IceFloor?
    – dstonek
    Commented Jan 21, 2014 at 21:44
  • I'm using IceFloor v2.0.2. Can you explain your answer a bit more on how to block a specific application from accessing internet? Commented Sep 1, 2014 at 5:01
  • 5
    tcpblock.wordpress.com is no longer available. Commented Jan 22, 2015 at 23:40
  • 1
    macupdate.com/app/mac/35914/tcpblock new home of tcpblock?
    – user2040
    Commented Jul 6, 2015 at 13:53
  • 1
    @barrycarter That's just a download hub, like CNet Commented Nov 23, 2015 at 16:44

LuLu is a great free, shared-source, macOS firewall that can block unknown outgoing connections, unless explicitly approved by the user. It runs on OSX 10.12+ and runs well on macOS Mojave. It can be configured to allow or block Apple signed binaries and has clear GUI based rule set that can be edited. Whilst it is free users are encouraged to support its development - which seems fair.

  • 1
    Thank you. This is the best answer. Free firewall & blocks by application. Just 13MB, clear, simple, and doesn't ask for unreasonable prices (for the little purpose of just blocking-all with whitelist). Commented Oct 14, 2019 at 16:04

Use Radio Silence. Very simple application, but does the job nicely, however it costs $9.

  • 2
    Welcome to Ask Different! Radio Silence appears not to be free. Also try linking people to what you are talking about... radiosilenceapp.com Commented Jul 17, 2015 at 20:40
  • +1. This is cheaper than little snitch so since there does in fact not seem to be a free alternative I think it is a a quite good attempt at the solution! (I had the same problem and went with this)
    – htd
    Commented Oct 14, 2016 at 7:32
  • This looks like a very good alternative to the quite expensive Little Snitch, thanks for sharing!
    – mrzool
    Commented Nov 22, 2017 at 17:18

If you know which server an application is trying to contact, and want to stop it from doing so, you can reroute all communication to a bogus IP address (like or just reroute traffic to itself (the local host). You need administrator privileges (sudo) for this to work.


# is a reserved character for starting ignored text. All other lines are parsed in space-separated columns. To stop all connections to facebook (blasphemy!):

# Col 1                 Col 2
# "routed to" address   hostname (dns)               www.facebook.com

Usually the effects are immediate, (like right now I just tried to make sure and it was immediate), but you could unload and reload the multicast dynamic naming service manually.

sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.mDNSResponder.plist
sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.mDNSResponder.plist

launchctl does not support restart like systemctl restart avahi-daemon:(. That is why you must run two commands.

Example of default /etc/hosts file

The name "localhost" works because it is routed here to the ip local host standard address of The cool thing is, you could change it. But that‘d be deviant of you!

# Host Database
# localhost is used to configure the loopback interface
# when the system is booting.  Do not change this entry.
##   localhost broadcasthost
::1             localhost

TCPBlock still works in OS X Yosemite (although it doesn't seem to work on El Capitan). Install it, restart the machine, open System Preferences and select TCPBlock. Unlock the pane then select the plus icon then Select Applications and choose Adobe Photoshop.

enter image description here

(sorry about download.com link)


I think you can through the firewall as stated in this article:

  1. Click the System Preferences icon in the Dock.
  2. Click the Security icon.
  3. Click the Firewall tab.
  4. Click the Start button to turn on your firewall.
  5. Click the Advanced button.
  6. Click the Automatically Allow Signed Software to Receive Incoming Connections radio button to select it.

This enables the firewall. And, by default, virtually all incoming TCP/IP traffic is blocked. You must enable each sharing method that you want to be able to use. When you enable different sharing methods from the Sharing pane in System Preferences (such as File Sharing or FTP Access), you’ll notice that those types of traffic now appear in the Firewall list. (In other words, when you turn on a sharing method, the firewall automatically allows traffic for that sharing method, which Snow Leopard calls a service.)

Click the up/down arrow icon to the right of any service to specify whether the firewall should allow or block connections.

Sometimes, you might want to allow other traffic through your firewall that isn’t on the firewall list of recognized services and applications. At that point, you can click the Add button (which bears a plus sign) to specify the application that your firewall should allow. Snow Leopard presents you with the familiar Add dialog, and you can choose the application that needs access.

  • 3
    It seems to me Firewall only blocks incoming traffic to an app but not outgoing traffic from an app.
    – ohho
    Commented Jun 19, 2013 at 1:08
  • 3
    Yes, the default firewall in OS X (as edited in this way) only blocks incoming traffic. It does not block outgoing connections from apps on your computer. The default OS X PF firewall blocks both ways (see my answer).
    – grg
    Commented Jun 20, 2013 at 14:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .