LuLu

LuLu is a firewall for Mac that watches outgoing network connections. When an app tries to connect for the first time, LuLu shows an alert and you choose to allow or block it. The built-in macOS firewall only handles incoming connections, so LuLu covers the other direction.

Each alert shows the app's code signing details and the processes that launched it, and can look the file up on VirusTotal, which sends only its hash. Your answer becomes a rule. Rules can cover a whole program or one remote address, can expire after a set time, and can use wildcards or regular expressions. You can edit, export and import them.

Block and allow lists can be loaded from local files or URLs. Passive Mode applies your rules without new alerts, and Block Mode stops all traffic except allow-listed destinations. Profiles, added in version 4, keep separate sets of rules and settings. The bundled Netiquette app shows live network activity, and since 4.5.4 blocked connections are written to the system log.

LuLu is made by the Objective-See Foundation and released under the GPL-3.0 licence. It needs macOS 10.15 or later and runs natively on Apple Silicon. It does not filter incoming traffic.