Choosing a Mac firewall
LuLu alternatives
LuLu is a capable free firewall, so switch only for a specific workflow it does not meet for you, such as how you manage a fleet or collect decision logs. Little Snitch adds a map and DNS encryption, Vallum adds inbound filtering and Wi-Fi conditions, and Outbound adds MDM rule delivery.
Updated
Written by Outbound, which is included below. Options are grouped by use case, not ranked. Sources were checked October 4, 2026.
Start with the reason to change
Check what your LuLu version already does: endpoint and port rules, timed rules, profiles, allow and block lists and rule import and export are all part of LuLu now. Switching means giving up a free, open-source licence, and Outbound cannot import LuLu’s rule format.
Options by use case
Little Snitch Mini
Pick it if what you miss in LuLu is a friendlier monitor, with traffic diagrams and a map view that are free to use. Blocking connections needs its in-app purchase, so as a free blocker it does not replace LuLu. Official product details.
Little Snitch
Pick it for a Network Monitor with a map and up to twelve months of traffic history, DNS encryption, and profiles that switch with your Wi-Fi network. It is commercial, with paid upgrades for new major versions. Official product details.
Vallum
Pick it when app rules conditioned on the network interface or SSID matter to you, or when you also want inbound filtering with popup alerts. Vallum 5 is $15 for a single licence and needs macOS 11.2 or newer; command line and MDM tools are not stated by the vendor. Official product details.
Outbound
Evaluate it for managed preferences, an HTTPS rule feed with optional pinning, exported JSON Lines decision logs and the outboundctl command line. Closed source and needs macOS 14 or later. Explore Outbound.
Tradeoffs worth checking
Outbound is not an open-source replacement for LuLu. If a free licence or inspectable source is the deciding requirement, staying with LuLu may be the right answer.
Outbound is closed source and has no published live compatibility results yet. Its Ask mode allows unanswered UDP connections after 8 seconds and TCP connections after 60 seconds by default; Strict mode blocks unmatched connections.
Plan a small evaluation
- Write down the capability you need and the price or licence constraints you have.
- Export the current firewall rules for reference. Do not assume another product can import them.
- Test one app and one destination before rebuilding a complete ruleset.
- Test your VPN and everyday tasks on the exact macOS build you use.
- Keep a recovery path: System Settings → Network → Filters, or your IT administrator.
Price and availability
Outbound personal is $39 USD one time ($29 for the first 50 licences) and includes 1.x and 2.x updates. Family is $59 USD for 5 Macs. Personal covers 2 Macs; there is no trial. For competitor regional pricing, trial terms and current release requirements, use the official links above.