Wednesday, December 24, 2025

Why is macOS Tahoe firewall suddenly blocking all network access?

macOS 26.1 (Tahoe), M4 MacBook Pro

Yesterday, I rebooted my MacBook and suddenly found that I had no network access, LAN or otherwise. Pinging 8.8.8.8 (or my router) gives No route to host — no difference if I hotspot from my cell (so it doesn’t seem likely to be a local network issue). Other devices on my LAN are working normally.

$ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
ping: sending packet: No route to host

Connecting to my router’s web interface with the firewall off (first try) and on (second try):

$ nc -vz 192.168.0.2 80
Connection to 192.168.0.2 port 80 [tcp/http] succeeded!
$ nc -vz 192.168.0.2 80
nc: connectx to 192.168.0.2 port 80 (tcp) failed: No route to host

I’ve not installed any updates or new software in the last few days. I have Mullvad VPN and Tailscale installed, but running or stopping them (via launchd) seems to make no difference. Rebooting (multiple times) makes no difference.

The only thing that restores network connectivity (and how I’m submitting this) is turning off the firewall in system settings; once that’s done, all network activity (local and otherwise) works again.

Running something like while :; do ping -c 1 my_router_ip; sleep 0.5; clear; done in a Terminal window, the pings immediately succeed or fail when I toggle the firewall off / on, respectively.

I don’t see any unusual or new apps listed in my firewall, and I haven’t blocked anything new that I can recall:

$ /usr/libexec/ApplicationFirewall/socketfilterfw --listapps |
    rg --no-line-number --before-context=1 Block
15 : /private/tmp/nix-build-tailscale-1.86.4.drv-0/go-build3319163091/b001/tsconsensus.test
             (Block incoming connections)
16 : /private/tmp/nix-build-tailscale-1.86.4.drv-0/go-build1352679619/b001/sniproxy.test
             (Block incoming connections)
17 : /private/tmp/nix-build-tailscale-1.86.4.drv-0/go-build1459137735/b001/tsconsensus.test
             (Block incoming connections)
18 : /private/tmp/nix-build-tailscale-1.86.4.drv-0/go-build3263885961/b001/sniproxy.test
             (Block incoming connections)
--
20 : /private/tmp/nix-build-tailscale-1.86.2.drv-1/go-build3523009091/b001/tsconsensus.test
             (Block incoming connections)
21 : /private/tmp/nix-build-tailscale-1.86.2.drv-1/go-build2206437402/b001/sniproxy.test
             (Block incoming connections)
--
33 : /nix/store/35zdlh430rvcz1j9jhpisvac0l6ldi43-source/chrome-mac/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/133.0.6943.16/Helpers/Chromium Helper.app
             (Block incoming connections)
--
120 : com.getdoxie.doxie
             (Block incoming connections)
--
123 : com.google.Chrome
             (Block incoming connections)
--
127 : com.elsevier.mendeley.helper
             (Block incoming connections)
--
135 : org.mozilla.plugincontainer
             (Block incoming connections)

Unfortunately, it looks like the firewall log in Console.app has been removed in Tahoe (??? WHY ???), so I can’t get any information from there.

EDIT: I reinstalled tahoe from recovery, didn’t change anything.

Related Articles

LEAVE A REPLY

Please enter your comment!
Please enter your name here

Latest Articles