Apple ships the pf fireball by default. It's a powerful firewall (same as OpenBSD AFAIK) but the way Apple configures it is very permissive. You can use a utility like Murus to configure it to your liking, although the configuration is rather complicated. It's also a network-level firewall, not an application-level firewall.

If you'd like an application-level firewall, you can check out Lulu or Little Snitch. Back when Little Snitch still(?) installed kernel extensions, it was found to be quite insecure—there were talks at DEFCON about it. Lulu is a lesser-known alternative.