Your laptop has a firewall. Here's how to use it.
Built into every Mac and Windows PC. On a stranger's Wi-Fi, its settings decide who gets an answer.
Every Mac and every Windows laptop has a firewall built in. It blocks connections that other computers start with yours, from the internet or from the network you're on. Even when it is on, it can still let some apps and sharing services through.
If you've never opened its settings, you don't know whether it's on or which of those exceptions are open.
Start with the switch
Turn it on
If it's off, it blocks nothing. Check it first.
Settings illustrations are for reference. Labels and layout may vary by operating system version.
Mac
Open Apple menuSystem Settings and click Network in the sidebar, then click Firewall. Scroll down if you don't see it. Turn on Firewall.
Windows
Open the Windows Security app and select Firewall & network protection. Select Domain network, Private network and Public network in turn, and make sure Microsoft Defender Firewall is On for each one.
Exceptions count
On still lets things in
A firewall that's on still has exceptions. On a Mac, turning on a sharing service such as file sharing opens a port for that service, and apps signed with a trusted certificate can be allowed through without asking you. On Windows, every app on the allowed list is an exception.
Mac
Click Options and read the list of apps and services. Set anything you don't recognize to block incoming connections. If an app you need stops working, set it back. Then turn off Automatically allow downloaded signed software to receive incoming connections, so new apps have to ask you first.
Windows
On Firewall & network protection, open Allow an app through firewall and select Change settings. Clear the check box next to anything you don't use or recognize, then select OK.
Apple's own advice for tighter control: turn off the sharing services you don't use. Open Apple menuSystem Settings and click General in the sidebar, then click Sharing, and turn off every service you don't use.
Install macOS Golden Gate 27.2 or later from System SettingsGeneralSoftware Update on the Mac. macOS Golden Gate 27.2, released Oct 26, 2026, fixes flaws in Remote Management and Screen Sharing. Apple says one of the Remote Management flaws can let a remote attacker run code on the Mac. Turning a sharing service off does not take the place of that update.
Apple's notes don't mention the firewall. This connection is ours: a sharing service set to "On" is open, and the firewall lets connections to it through. If you don't use a service, turn it off.
Strangers' networks
On Wi-Fi you don't trust
At a coffee shop, an airport or a hotel, most of the other devices on the network belong to strangers. The firewall decides which of them get an answer from your laptop.
Mac
Turn on Block all incoming connections. This also blocks connections to sharing services such as file sharing and screen sharing, until you turn it off. Turn on Enable stealth mode too. Your Mac stops answering probes such as ping, so it's harder to find on a network. Apps you've allowed keep working.
Windows
Open Public network and check Blocks all incoming connections, including those in the list of allowed apps. Microsoft warns this can stop some apps from working.
Windows 11 sets every new network to Public. Public hides your PC from the other devices on the network and turns off file and printer sharing.
To check, go to SettingsNetwork & internetWi-Fi select your network, and under Network profile type choose Public network (Recommended). On a cable, select Ethernet instead of Wi-Fi.
Microsoft says to use Private only on a network where you know and trust the people and devices.
Next, Part 2: which services to shut down, which are your call, which to let ride, and the port behind each.
About the author
Editor in chief, The Bravo Protocol
Real-world experience as VIP security, engineer, and United States Marine. Classically trained in Information Management, Security, and Network Assurance with a specialization in IT forensics.
An expert advisor that's led teams and engineering initiatives for Fortune 500 companies and an AI/ML unicorn startup.
Show the receipts
Sources and notes
What each source supports in this guide. Pages opened Oct 29 to 31, 2026, and re-opened Nov 6, 2026.
Apple
- Block connections to your Mac with a firewall, Mac User Guide (macOS 27). Where the firewall switch is; a sharing service opens a port; apps with a trusted certificate can be allowed through.
- Change Firewall settings on Mac, Mac User Guide (macOS 27). Block all incoming connections, the automatic-allow switch for downloaded signed software, stealth mode, and turning off the sharing services you don't use.
- Change Sharing settings on Mac, Mac User Guide (macOS 27). Where the Sharing list lives: System Settings > General > Sharing.
- Keep your Mac up to date, Mac User Guide (macOS 27). Where Software Update lives: System Settings > General > Software Update.
- About the security content of macOS Golden Gate 27.2, Apple Support. Released Oct 26, 2026; the Remote Management and Screen Sharing fixes, including a Remote Management flaw that can let a remote attacker run code.
Microsoft
- Configure Windows Firewall with the command line, Microsoft Learn. Non-Microsoft firewall software can programmatically disable only the Windows Firewall rule types that need to be disabled for compatibility. Microsoft says not to turn the firewall off yourself for that purpose.
- Firewall and network protection in the Windows Security app, Microsoft Support. The On switch for each network type, the block-all check box and its warning, and that an organization's policy can lock these settings.
- Risks of Allowing Apps Through Windows Firewall, Microsoft Support. How to clear an app from the allowed list.
- Essential Network Settings and Tasks in Windows, Microsoft Support. New networks start as Public; Public is recommended at home, at work and in public places; Private only where you know and trust the people and devices.
Our calls
Every line marked "Our call" is our editorial judgment, resting on the sources above. Where we connect two facts a vendor didn't connect, the text says so.