Scudo Firewall 4+

Intercept and block inbound and outbound network connections. Increase your privacy and save bandwidth preventing apps from connecting to the Internet.

Scudo is a hybrid firewall with an easy and intuitive interface. It helps you protecting your computer’s network services from unwanted connections from remote computers and improves your privacy and security by controlling all apps' network activities letting you to choose which apps are allowed to connect to the network.
Scudo firewall policies can be configured to be inclusive, exclusive or interactive. So you decide if you want a completely silent firewall that does not require your interaction, or an interactive firewall that requests your action when needed.

OUTBOUND FIREWALL
Outgoing connections are filtered at application layer.
When an app tries to connect to the network, Scudo shows a notification from which you can choose on the fly whether to allow or deny the connection. You can choose whether to apply the rule to all connections of a particular app or to apply it only to a specific IP address, to a range of IPs, a hostname or a domain. Apps will never be able to connect to the network without your explicit consent. Each app has its own policy, and you can create complex rule sets that apply to all apps and directories.

INBOUND FIREWALL
Incoming connections are filtered at network layer.
If a remote computer attempts a connection to your computer's network services, such as remote login, file sharing or screen sharing, Scudo shows a notification from which you can choose on the fly whether to allow or deny the connection. You can choose whether to apply the rule to all connections or only to an IP address or to a range of IPs. Services can be customized: Scudo offers a library of predefined services, the most known and common, but it is possible to add more if necessary.

PROTECTION FROM INSECURE WIFI HOTSPOTS
This type of protection is optional. When activated, if the computer is connected to a WiFi access point considered insecure, all incoming connections are always blocked, regardless of the rules. This allows you to use permissive rules when connected to a WiFi that you consider safe, such as for example that of your home or office, and to be able to connect to other random and unknown WiFi knowing that in that case no one will be able to connect to your network services.
So when you are away from home and connected to a public WiFi you no longer have to remember to disable file sharing or screen sharing, because Scudo will take care of blocking all connection attempts.

BLOCK LIST
Define a global block list using IP addresses or CIDR network addresses. All inbound and outbound connections from/to these addresses are blocked, for your peace of mind. So you can take advantage of public lists of well-knows dangerous and malicious addresses and networks to increase your privacy and security of your computer.

PROFILES
Create your own custom profiles and switch between profiles with a single mouse click in order to adapt your firewall settings to current operating environment.

EASY TO USE
The first time you launch Scudo you will be able to start its configuration with a very clear, simple and comprehensive assistant, which will guide you in two short steps and then you can immediately start using your firewall.
Normally Scudo rules are persistent, but you can also create temporary rules. In any case, Scudo will ask you if you want to automatically launch Scudo when you log in, so you are sure that, if you want, the firewall will always be active and you will always be protected by its rules.
Scudo is a lightweight and easy app, it uses few system resources, it is controlled by its small shield-shaped icon in the macOS menubar, next to the clock.
Scudo is for everyone: even those unfamiliar with firewalls and networks in general can use Scudo to protect their security and privacy.