A firewall that asks before your apps connect.
The firewall built into macOS only screens incoming connections. OpenNavo’s app firewall watches the other direction: the first time an app connects to the network, it asks whether to allow or block it, and remembers your answer. Free and open source.
Free · macOS 13 or later · Apple silicon and Intel
What it does
Every rule is yours, and everything is decided on this Mac.
Asks before apps connect
See which app it is, where it’s connecting and who signed it, then allow or block it.
Rules by app, site or port
Allow a whole app, or allow or block just one domain, IP range or port. More specific rules win, and at the same level Block wins over Allow.
Block lists
Import hosts files or lists of ad, tracking or malicious sites. Matching connections are blocked without asking, and lists from a web address update daily.
Fewer questions when you want
Connections without a rule can ask you, be allowed and logged, or be blocked and logged. Apple programs and apps you already have can be allowed automatically.
How it works on your Mac
The app firewall is a network system extension. The first time you turn it on, macOS asks you twice: allow OpenNavo’s system extension in System Settings, then allow it to filter network content. Connection details stay on your Mac and are never uploaded.
It needs macOS 13 or later and the release version of OpenNavo in the Applications folder.
What it doesn’t do
- It only covers connections that apps on this Mac start. Incoming connections are the job of the firewall built into macOS (System Settings → Network → Firewall).
- While OpenNavo isn’t running it can’t ask, so a connection without a rule is allowed for now and logged under Activity. Your existing rules keep applying.
- Some apps look up an address themselves and connect straight to an IP, so blocking a domain can miss them; only IPs on a list stop those connections.
- The app firewall ships only in the signed release version. Development and unsigned builds don’t include it.
Adapted from LuLu
The app firewall’s network filter adapts LuLu 4.5.1, the free, open-source firewall by Objective-See (Patrick Wardle), under the GPL-3.0 license. OpenNavo rewrote its rule handling, storage and interface, and isn’t affiliated with or endorsed by Objective-See. OpenNavo’s own code is open source under GPL-3.0 as well, and public on GitHub.
Other Mac security apps in the catalog
These apps are listed in OpenNavo’s catalog too, if you want to compare. Each comes from its own developer and has no partnership with OpenNavo.
Questions
Doesn’t a Mac already have a firewall?
It does. macOS includes a firewall in System Settings → Network → Firewall. It controls incoming connections, which matters most on public Wi-Fi. It doesn’t ask you when an app connects out to the internet; an app firewall covers that part.
Is it free?
Yes, and there’s no account. OpenNavo, including the app firewall, is open source under the GPL-3.0 license.
Will it stop my apps from working?
Apps you block can’t connect, which can stop their updates or syncing. If you’d rather not be asked so often, set connections without a rule to Allow & Log and review them under Activity, or allow the apps you already have automatically.
Does it send my connections anywhere?
No. Rules and decisions are made on your Mac, and connection details aren’t uploaded. Block lists you add from a web address are downloaded to your Mac and checked there.
How do I remove it?
In OpenNavo, open App Firewall → Settings and choose Remove. That turns off filtering and uninstalls the system extension, deleting your rules and activity log. macOS may ask for your password.
More on Mac security
Turn on the app firewall.
OpenNavo is free and open source for macOS 13 and later. After installing it, open App Firewall and confirm the two macOS prompts.
brew install --cask opennavo