Tinkersoft · Workbench
Sign in Sheet 03 · NetGuard
macOS firewall + encrypted DNS · v1.0.1
NetGuard app icon

NetGuard

See every connection your Mac makes — and decide who gets out. A per-app firewall and live traffic monitor — with a full encrypted DNS proxy built in, the kind you'd otherwise buy on its own. Two tools, one price.

Buy NetGuard $39.99 One-time · lifetime license
macOS 15+ Apple-notarized Universal · Apple Silicon + Intel
Plate 01 · Dashboard NetGuard's Dashboard: NetGuard is active, with live-connection, data-in, data-out and blocked counters, a live traffic graph, top processes, recent blocks, and a status bar showing the filter, daemon and DNS proxy all enabled.
The Dashboard — connections, throughput, blocks and system health at a glance.
What it does

A firewall that shows its work.

NetGuard intercepts connections at the process level, checks each against your rules, and either allows, denies, or asks — so nothing leaves your Mac unseen.

01

Per-app firewall

Every outgoing connection is matched to the app that opened it, then allowed, denied, or held for you to decide.

02

Ask, once

A clean alert names the app, host and port. Answer once and NetGuard remembers the rule — by app, domain, or connection.

03

Live traffic monitor

Watch connections as they happen, ranked by app, plotted on a world map with GeoIP — see exactly where traffic goes.

04

Encrypted DNS

A built-in proxy resolves names over DoH, DoT and DoQ, so lookups stay private and can't be sniffed on the wire.

05

Blocklists built in

Millions of tracker and malware domains, blocked before they resolve — updatable, and enforced at the DNS layer.

06

Native & private

SwiftUI + NetworkExtension, with an encrypted rules database on-device. No accounts, no telemetry — signed and notarized.

Live map

Watch every connection, in and out.

Outgoing and incoming traffic is plotted by GeoIP and animated in real time — see where your Mac is reaching out to, and who's reaching back.

Plate 02 · Connection Map NetGuard's Connection Map animating: pulses of traffic travel along arcs from the user's Mac out across a world map to destinations in Europe, the Americas and Asia.
Connection Map — live traffic, mapped by GeoIP.
Two tools in one

A firewall and an encrypted DNS resolver.

NetGuard isn't just an app firewall. It ships a full encrypted-DNS proxy too — the kind you'd otherwise buy separately. One purchase, both jobs.

1 Application firewall

Control who gets out

Per-app, per-connection verdicts with a live monitor and a world map.

  • ✓ Allow, deny or ask on every new connection
  • ✓ Rules by app, domain, port & network
  • ✓ Incoming connections filtered too
2 Encrypted DNS proxy

Control how names resolve

A built-in resolver that keeps your lookups private and blocks the junk.

  • ✓ Encrypted DoH, DoT & DoQ — no plaintext DNS
  • ✓ Millions of tracker & malware domains blocked
  • ✓ Every query logged, searchable, on-device
Settings · DNS NetGuard's DNS settings: DNS Encryption enabled, provider choice of Quad9, Cloudflare, Google Public DNS, dns0.eu or a custom server, protocol set to DNS over HTTPS, and a live status showing the connection active with hundreds of queries resolved.
Encrypted DNS — Quad9, Cloudflare or dns0.eu over DoH/DoT/DoQ.
Blocklists NetGuard's Blocklists screen: curated ad, tracking, malware and phishing lists — AdGuard DNS Filter, OISD, Steven Black's Unified Hosts, Hagezi and more — each toggleable, blocked at the DNS layer.
Blocklists — OISD, Hagezi, Steven Black & more, blocked before they resolve.
The tour

Every screen, built for control.

A real macOS app — not a menu-bar toy. Eight screens for monitoring, rules, blocklists, insights and network profiles, each doing one job well.

Monitor NetGuard's Monitor: a live connection list grouped by app on the left with filters (All, Active, Denied, Pending) and a per-process breakdown, beside the GeoIP world map.
Monitor — live connections by app, filterable, beside the map.
Rules NetGuard's Rules table: dozens of per-app rules with real app icons, each showing verdict (Allowed/Pending), port, direction and last-modified, with verdict filters and a search field.
Rules — one row per app, allow/deny/ask, grouped or searched.
Rule editor NetGuard's Edit Rule sheet: choose Action (Allow/Deny/Ask), Direction, a specific process or any, destination by domain/hostname/IP/CIDR/local network, and port and protocol (TCP/UDP/ICMP).
Rule editor — action, direction, process, destination, port & protocol.
Insights NetGuard's Insights: a list of suggestions to harden rules, such as upgrading a path-based process match to code-signature matching so a replaced binary can't impersonate an app.
Insights — hardening suggestions, like code-signature matching.
Probes · detected NetGuard's Probe Detection screen listing real inbound probes it caught — source IPs, severities, and techniques including udpProbe, synScan and traceroute detection.
Detected probes — inbound scans: udpProbe, synScan and traceroute.
Settings · Probes NetGuard's Probe Detection settings: enable inbound reconnaissance detection via BPF packet capture, with scan thresholds and detection modules for ICMP redirects, ARP spoofing, DNS reconnaissance and OS fingerprinting.
Detection modules — ICMP redirect, ARP spoofing, DNS reconnaissance, OS fingerprint.
The model

Your rules, enforced on the device.

  • 01Ask before it leaves. New connections pause for a verdict — you allow or deny, and the choice becomes a rule.
  • 02Everything is local. Rules and traffic history live in an encrypted database on your Mac. Nothing is sent to us.
  • 03Incoming too. Inbound connections run the same rule engine, with a policy you set — follow, deny-all, or always ask.
  • 04Never holds traffic hostage. If a license ever can't be verified, filtering steps aside — the network keeps working, it just stops guarding.
Connection alert — app, host, port and location. Answer once; it becomes a rule.
Specification

Native, signed, universal.

A direct download, not the Mac App Store — a system-wide network filter can't run inside the App Store's sandbox. Every copy is signed and notarized by Apple, so it installs cleanly with no security warnings.

ProductNetGuard
Version1.0.1
PlatformmacOS 15.0+
ArchitectureUniversal
Signed byApple Developer ID
NotarizedApple-verified
CategoryApplication firewall & traffic monitor · utilities
Purchase

Own it once. Guard forever.

A one-time license for NetGuard 1.0 — every 1.x update included. Handled internationally by Creem, with tax and receipts sorted.

✓ Lifetime license ✓ Notarized download ✓ 14-day refund
$39.99
One-time · USD
Buy NetGuard