Block connections to your Mac with a firewall
A firewall can protect your Mac from unwanted contact initiated by other computers when you’re connected to the internet or a network. However, your Mac can still allow access through the firewall for some services and apps. For example:
If you turn on a sharing service such as file sharing, macOS opens a specific port for the service to communicate through.
An app or service on another system can request and be given access through the firewall, or it might have a trusted certificate and therefore be allowed access.
For greater control, you can select apps and services, and specify whether they can have access through the firewall.
Turn on firewall protection
On your Mac, choose Apple menu
in the sidebar, then click Firewall. (You may need to scroll down.)Turn on Firewall.
To specify additional security settings, click Options, turn settings on or off, then click OK. See Change Firewall settings.
Set firewall access for services and apps
On your Mac, choose Apple menu
Click Options.
If the Options button is disabled, first turn on Firewall.
Click
under the list of applications and services, then select the apps or services you want to add. After an app or service is added, click its up and down arrows 
and choose whether to allow or block connections through the firewall.Blocking an app’s access through the firewall could interfere with or affect the performance of the app or other software that may depend on it.
Important: Certain apps that don’t appear in the list may have access through the firewall. These can include system apps, services and processes, as well as digitally signed apps that are opened automatically by other apps. To block access for these programs, add them to the list.
When your Mac detects an attempt to connect to an app you haven’t added to the list and given access to, an alert message appears asking if you want to allow or deny the connection over the network or internet. Until you take action, the message remains and any attempts to connect to the app are denied.