Choosing a Mac firewall
Little Snitch alternatives for Mac
If you are leaving Little Snitch, LuLu is the free, open-source choice, Little Snitch Mini and Radio Silence are simpler, and Outbound suits managed Macs. Choose by the feature you want to change, not by the alert window.
Updated
Written by Outbound, which is included below. Options are grouped by use case, not ranked. Sources were checked October 4, 2026.
Start with the reason to change
Write down what you use in Little Snitch today: the map, traffic history, DNS encryption, blocklists, Wi-Fi profile switching or the command line. Each option below drops some of these, and Outbound cannot import Little Snitch rules, so a switch means rebuilding and testing your policy.
Options by use case
LuLu
Pick it when free software and inspectable source are requirements. It has alerts, endpoint and port rules, timed rules, a Passive mode, profiles, allow and block lists and a bundled monitor. A traffic map and DNS encryption are not stated by the vendor. Official product details.
Little Snitch Mini
Pick it if you want Objective Development’s simpler single-window monitor. The real-time connection list, traffic diagrams and map view are free to use. Blocking connections needs an in-app purchase on a subscription licence. Official product details.
Radio Silence
Pick it when you want to block entire apps quietly, with no pop-ups, for $9 one time, with a real-time network monitor. Rules for individual hosts or ports are not stated by the vendor, so per-host exceptions need a different tool. Official product details.
Outbound
Evaluate it for per-app rules by host, domain, IP, CIDR range and port, a pinned HTTPS managed feed and JSON Lines audit export. Its alerts quote an app’s Internet Access Policy, the format Little Snitch uses. It has no DNS encryption in v1. Closed source, $39 USD personal ($29 for the first 50 licences), version 1.0. Explore Outbound.
Tradeoffs worth checking
Outbound v1 does not include Little Snitch’s DNS encryption or long traffic history, and it has no importer for Little Snitch rules. Do not switch solely because two screenshots show an Allow button.
Outbound is closed source and has no published live compatibility results yet. Its Ask mode allows unanswered UDP connections after 8 seconds and TCP connections after 60 seconds by default; Strict mode blocks unmatched connections.
Plan a small evaluation
- Write down the capability you need and the price or licence constraints you have.
- Export the current firewall rules for reference. Do not assume another product can import them.
- Test one app and one destination before rebuilding a complete ruleset.
- Test your VPN and everyday tasks on the exact macOS build you use.
- Keep a recovery path: System Settings → Network → Filters, or your IT administrator.
Price and availability
Outbound personal is $39 USD one time ($29 for the first 50 licences) and includes 1.x and 2.x updates. Family is $59 USD for 5 Macs. Personal covers 2 Macs; there is no trial. For competitor regional pricing, trial terms and current release requirements, use the official links above.