How to run one Mac app offline without disconnecting Wi-Fi

Why run only one app offline?

• Offline-mode testing: verify a Mac app handles timeouts, cached content, queued work, and reconnection gracefully.
• Local creative work: use an editor or utility without background update, analytics, or cloud calls.
• Untrusted software: reduce direct network exposure while evaluating an app—though a VM is the stronger boundary.
• Reproducible demos: prevent a changing backend from affecting a local presentation while keeping other tools online.
• Debugging: distinguish a local feature from a remote dependency without changing router or DNS settings.

Turning off Wi-Fi tests the entire machine. That can hide bugs caused by selective failure, because every dependency—including your documentation and test tools—disappears at once. A per-app deny policy creates a more focused condition.

Set up a one-app offline test with Faraday Cage

1. Close the target app. Existing TCP sessions and helper processes must stop before a clean test begins.
2. Add the app to the Cage. Select the application bundle from /Applications.
3. Choose Deny all. Leave global rules enabled only if you want existing global exceptions to apply.
4. Restart under the Cage. The app should start only after the local protection components and policy agree.
5. Run the offline scenario. Trigger sign-in, sync, update, export, or any other path that normally reaches the network.

How to prove the test is selective

A good offline test has both a negative and a positive control:

• Negative control: the caged app cannot complete a fresh remote request.
• Positive control: Safari or another uncaged app can load a never-before-opened page.
• Local evidence: the firewall records denied activity for the target app.
• Cold start: the result persists after fully quitting and relaunching the target app.
• Protocol coverage: test features that may use UDP or QUIC, not only an obvious TCP request.

A cached screen saying “offline” is not proof, and a failed DNS lookup is not proof that every raw-IP path is denied. Test the behavior you actually care about.

Allow one service while the rest stays offline

Sometimes “offline” really means “local-only except for licensing” or “allow this API, deny analytics.” Start from Deny and add the narrowest exception that restores the required feature:

1. reproduce the blocked feature;
2. open the matching event;
3. choose a host, endpoint, path, or supported method-and-path scope;
4. allow it and repeat the test;
5. watch for fallback destinations before broadening the rule.

Endpoint-specific rules are usually safer than allowing the entire host, and app-specific rules are safer than a global exception when only one application needs it.

When to use a VM instead

A per-app firewall controls supported network flows. It does not provide a full filesystem, keychain, camera, microphone, or IPC sandbox. If the software is actively untrusted, run it in a virtual machine with no network adapter and no shared folders.

Faraday’s process-family guard is designed to follow descendants exposed through macOS audit-token relationships. Arbitrary commands sent to an unrelated already-running process remain outside the stated boundary. The full build 34 guard plane is also awaiting signed runtime acceptance.