Choosing a Mac firewall
Radio Silence alternatives
Look beyond Radio Silence when an app must stay online while you restrict specific destinations. LuLu does that for free, Little Snitch and Vallum add more monitoring and rule options, and Outbound adds MDM rule delivery.
Updated
Written by Outbound, which is included below. Options are grouped by use case, not ranked. Sources were checked October 4, 2026.
Start with the reason to change
Radio Silence’s quiet, whole-app blocking is a deliberate workflow, and it costs $9 one time. If you only need an app offline, moving to a more detailed firewall can create work without solving a new problem.
Options by use case
LuLu
A free, open-source firewall whose rules can be scoped to a remote endpoint and port, or set to expire. Start here if cost is the main constraint. Connections no rule covers raise an alert unless Passive mode is on, which can mean more prompts than Radio Silence at first. Official product details.
Little Snitch
A commercial option with connection alerts, Silent Mode, a network map and DNS encryption, and rules that limit an app to specific servers, domains, ports or protocols. Weigh whether those extra tools are worth the price and the alerts. Official product details.
Vallum
An app firewall whose rules match hostname, domain, IP address or port, with conditions for Wi-Fi network and interface, and inbound filtering too. It runs as an interactive firewall with popup alerts by default, so a quiet setup takes configuration. Official product details.
Outbound
Per-app rules for hosts, domains, IP addresses and network ranges, with six lifetimes and Learn, Ask or Strict modes; Learn and Strict run without prompts. Closed source, $39 USD personal ($29 for the first 50 licences), version 1.0. Explore Outbound.
Tradeoffs worth checking
More rule scope needs more judgement: a destination name does not tell you that a connection is analytics, and a block may interrupt authentication or updates. Test one narrow rule at a time.
Outbound is closed source and has no published live compatibility results yet. Its Ask mode allows unanswered UDP connections after 8 seconds and TCP connections after 60 seconds by default; Strict mode blocks unmatched connections.
Plan a small evaluation
- Write down the capability you need and the price or licence constraints you have.
- Export the current firewall rules for reference. Do not assume another product can import them.
- Test one app and one destination before rebuilding a complete ruleset.
- Test your VPN and everyday tasks on the exact macOS build you use.
- Keep a recovery path: System Settings → Network → Filters, or your IT administrator.
Price and availability
Outbound personal is $39 USD one time ($29 for the first 50 licences) and includes 1.x and 2.x updates. Family is $59 USD for 5 Macs. Personal covers 2 Macs; there is no trial. For competitor regional pricing, trial terms and current release requirements, use the official links above.