Turn on the built in firewall on every developer laptop: System Settings, Network, Firewall on a Mac, and Windows Security, Firewall and network protection on Windows. It blocks unwanted incoming connections, which matters when your laptop sits on a cafe, hotel or home network with other devices.
Why developers need this more than most
Developers run things that listen on ports: dev servers, databases, debug endpoints, local MCP servers and container runtimes. A service bound to all network interfaces instead of only localhost is reachable by anyone on the same Wi-Fi. A firewall is a second layer when a tool starts with a loose default.
CISA's home network guidance recommends enabling host based firewalls on computers, using the built in operating system firewall or one bundled with antivirus.
macOS
Per Apple's guide:
- Open System Settings and click Network in the sidebar, then Firewall. You may need to scroll.
- Turn on Firewall.
- Optionally click Options to adjust additional settings, then OK.
Apple says the firewall can block unwanted connections that other computers try to start while your Mac is on a network. Some access still gets through. A sharing service such as file sharing opens a specific port, and apps or services that request access or have a trusted certificate may be allowed. In Options you can set each app to allow or block incoming connections.
I did not find stealth mode described on that page, so check Apple's firewall settings article if you want details.
Windows
Per Microsoft's guide:
- Open the Windows Security app and go to Firewall and network protection.
- Select the network profile you are connected to: Domain, Private or Public.
- Under Microsoft Defender Firewall, set the toggle to On.
If your organisation manages the device, policy may stop you from changing the setting. Ask your administrator in that case.
Turn it on for all three profiles, not only the one you are using today. People move between networks.
What a firewall does not do
- It does not stop outbound connections from malware, in the default setups described above.
- It does not stop attacks that arrive through your browser, a dependency or an email attachment.
- It does not fix a service you deliberately exposed.
A habit for local servers
Bind development servers to localhost unless you truly need LAN access. When you do, expect a firewall prompt, and read it. If you accept every prompt, the firewall is decoration.
For MCP servers specifically, see sandboxing local MCP servers.
Quick check
Is the router firewall enough on its own?
No. It does not help when you leave your home network. A host firewall travels with the laptop.
Sources
- Block connections to your Mac with a firewall, Apple Support
- Turn Microsoft Defender Firewall on or off, Microsoft Support
- Home network security, CISA
Last reviewed: 19 October 2026.
