Block network has to make sure that a specific app can't open any connection while the VPN is off, even after you quit 5UF or restart. That requires the operating system to block outgoing connections per app, and the two systems provide this differently.
Windows: built in, nothing extra to install
Windows has a built-in network filtering framework (the Windows Filtering Platform, which the Windows firewall is built on) that accepts per-program blocking rules. 5UF already installs a background service with administrator rights, which adds the blocking rules to the Windows Filtering Platform, so no extra driver or extension is needed.
macOS: only possible through Apple's network extensions
• The built-in macOS firewall only handles incoming connections; it can't stop an app from connecting out.
• The low-level packet filter (pf) only knows IP addresses and ports; it can't tell which app opened a connection.
• Apple requires third-party software that filters network traffic per app to use Apple's Network Extension framework. So 5UF installs a small network filter extension: macOS tells it which app each connection comes from, and it allows or blocks it.
Why you have to approve it yourself: a network extension can see network connections, so for security Apple requires the user to turn it on in System Settings and allow it to filter network content. No software can do this step for you. The 5UF extension is notarized by Apple, only blocks apps you turned Block network on for, and doesn't record or change other apps' traffic.
Not installed unless you use it: the extension is installed only the first time you turn on Block network. Using the VPN, per-app routing or pinned routes doesn't need it. To stop using it, turn off 5UF VPN in System Settings → General → Login Items & Extensions → Network Extensions.
For installation steps and common messages, see "On desktop, how do I stop an app from going online without the VPN?".
