The problem was simple. The usual workflow was not.
Sometimes I know the result I want before I know anything about the connections involved: this application should work locally, but it should not be able to reach the internet.
macOS includes a firewall, but its main purpose is controlling incoming connections. Outbound firewalls solve a different problem. Many capable tools approach it connection by connection, asking the user to inspect destinations, processes and rules. That depth is useful when it is what you need. For this particular job, I wanted the application itself to be the unit of control.
That became the core idea behind NetBlocker: drag an app into a list, and its new network connections are blocked.
App-centred, including the less visible parts
A macOS app is not always a single process. It may rely on helper applications, XPC services and background components that make their own network connections. Blocking only the obvious main executable can therefore create a false sense of control.
NetBlocker discovers relevant signed components inside an application bundle and groups them under the app the user selected. The interface can show those related network processes without turning the main workflow into a process-management tool.
This required care. Generic executables such as Node, Java or Python cannot be treated as belonging to every app that bundles or launches them. Process identity needs enough signing and bundle context to avoid blocking unrelated software elsewhere on the Mac. That distinction became one of the most important technical lessons in the project.
Quiet by design
NetBlocker does not ask the user to approve each new connection. The decision has already been made at the app level: blocked or allowed. The main screen is deliberately small, with a drop area, a blocked-app list and a clear protection state.
The goal is not to replace detailed network analysis. It is to make a common outcome fast and predictable. I wrote a practical guide explaining how to block internet access for a Mac app, including what happens to existing connections and background helpers.
The product decision in one sentence: choose the app first, let NetBlocker handle its relevant network processes, and keep the interface out of the way.
Shipping outside the Mac App Store
A network filter needs capabilities that do not fit neatly into a conventional sandboxed Mac App Store product. NetBlocker is distributed directly as a signed and notarized application for Apple silicon Macs.
Direct distribution made the invisible parts of a trustworthy Mac product very visible to me:
- signing the main application and its system extension correctly;
- notarizing every public release and presenting a familiar drag-to-Applications installer;
- explaining the one-time macOS approval flow clearly;
- building licensing and updates without making the app feel permanently online;
- ensuring the UI never claims protection is active when it is not.
Those details are not marketing features, but they determine whether a security-related utility earns trust.
Why €4.99 lifetime
I wanted the price to match the scope of the product. NetBlocker solves one focused problem and should be an easy purchase for someone who values that workflow. It includes a seven-day trial and costs €4.99 for a lifetime licence.
The paid model supports signing, notarization, ongoing compatibility work and direct support. It also lets the product stay focused: no advertising, no sale of usage data and no catalogue of blocked apps collected remotely.
What I learned
The hardest part was not drawing the interface or dropping packets. It was making the state of the whole system understandable: extension approval, protection state, trial and licence status, updates, app helpers, and failure cases all have to agree.
User feedback repeatedly brought the product back to that principle. A tool like this should never leave someone believing an app is blocked when protection is actually unavailable. Clear states and conservative behaviour matter as much as the filtering itself.
NetBlocker remains intentionally small. That is not a temporary lack of features; it is the shape of the product.