Mac firewall comparison
Outbound vs Vallum and Murus
Pick Murus if you want to manage the macOS pf packet filter, and Vallum if you want an app firewall that also filters inbound connections and ties rules to Wi-Fi network or interface. Pick Outbound if your priority is per-app outbound rules delivered by MDM with audit export.
Updated
Published by Outbound, one of the products compared. This is a feature and workflow comparison, not an independent ranking or performance benchmark.
At a glance
| Criterion | Outbound | Vallum and Murus |
|---|---|---|
| Price and licence | Closed source. Personal $39 USD one time ($29 for the first 50 licences) with all 1.x and 2.x updates; family $59 USD for 5 Macs; Teams per seat, billed yearly | Vallum 5: $15 single, $20 five-licence family pack. Murus: Lite free for non-commercial use, Basic $10, Pro $25. Prices exclude VAT. Source availability: Not stated by the vendor |
| Filtering model | Network Extension app rules | Vallum: app firewall (content filter); Murus: pf front end |
| Per-app rules | Signed app by team and signing ID, or an exact path | Vallum: one app by fingerprint or path, or many apps by path, signature, origin or Developer ID |
| Host, domain and port rules | Host, domain, IP, CIDR and ports | Vallum: hostname/domain matching, plus IP address, port, protocol, source and user ID |
| Alert behaviour | Ask mode alert names the app, its developer from the signing certificate, port and protocol, and quotes an app’s Internet Access Policy when one is shipped (apps signed by a developer team or Apple). The rule can cover only this port, any port, or any port and protocol. Unanswered: allowed after 8 s (UDP) or 60 s (TCP) by default; TCP wait adjustable from 15 to 120 s, or block instead | Vallum: popup holds the connection; per the Vallum 4 help, an alert expires after 10 seconds by default and the resulting rule passes the connection for 2 minutes |
| Silent modes | Learn allows unmatched connections and adds them to Review; Strict blocks them. Your rules apply in every mode | Vallum: inclusive, exclusive or interactive; a flow with no matching rule is passed |
| Network monitor | Network Monitor grouped by app, with Sent, Received and Last Seen columns, exact bytes per destination once a connection closes, a traffic chart where you can select a time window, search scoped by app, host, port, protocol, country, direction or rule, and a map of server locations | Vallum: Flows Monitor of inbound and outbound connections, with blocking on the fly |
| Blocklists | Hosts, domain or CIDR lists over HTTPS, up to 200,000 entries per list | Vallum: Not stated by the vendor. Adsorb, a network-level ad blocker, is in the Pro Bundle |
| Network conditions and profiles | Profiles; no SSID-based profile switching in v1 | Vallum: rule conditions on SSID and interface, used instead of profile switching |
| Command line | outboundctl: status, rules, export and import, profiles, blocklists, audit export, feed checks | No dedicated tool stated. Older Murus manuals describe inspecting and loading its PF rules with the system pfctl tool |
| Managed deployment | Pinned rule feed and audit export, with sample MDM profiles and managed preferences | MDM: Not stated by the vendor. Older Murus manuals describe copying setups to other Macs with Murus Pro Vials and Murus Injector |
| macOS and release status | macOS 14 or later, Apple silicon or Intel. Version 1.0, public download | Vallum 5.1 needs macOS 11.2 or newer, with a 6.0 beta for macOS 27 and a 15-day trial. Murus 2.7 needs macOS 10.14.4 or later |
Competitor details: Vallum and Murus official product documentation, retrieved October 4, 2026.
Price and licence
Vallum 5 lists $15 for a single licence and $20 for a five-licence family pack, with a $7.50 upgrade; prices exclude VAT. Murus Lite is free for non-commercial use, Murus Basic is $10 and Murus Pro is $25, and the Pro Bundle with Vallum is $40. Retrieved October 4, 2026; confirm currency and tax at checkout. Seller’s page.
Outbound personal is $39 USD one time ($29 for the first 50 licences) with all 1.x and 2.x updates. Family is $59 USD for 5 Macs. Personal covers 2 Macs; there is no trial. Outbound is closed source.
Where Vallum or Murus is the better choice
Vallum filters inbound as well as outbound app connections, and a single rule can depend on the Wi-Fi network or an active interface. Murus exposes pf features Outbound does not offer, including port knocking, an adaptive firewall, NAT and bandwidth management, and Murus Lite is free for non-commercial use. Both run on older macOS versions than Outbound and are available now.
Do I need an application firewall or a packet filter?
Murus exposes pf network-layer controls. If your job is packet policy or network infrastructure, compare those controls directly rather than treating an app alert as an equivalent. If your question is which app may reach which host, Vallum is the closer comparison to Outbound’s per-process decisions. The Murus Pro Bundle includes both.
Do not assume profile parity
Vallum ties rule conditions to SSID and interface, and its help says this replaces switching between profiles. Outbound supports profiles but does not promise SSID-based switching in v1. Choose based on the condition you actually need to enforce.
Unanswered alerts work differently
The Vallum 4 help says an alert expires after 10 seconds by default and its rule passes the connection for 2 minutes; Vallum 5 added an option to keep a persistent unconfirmed rule instead. Outbound waits 8 seconds for UDP and 60 seconds for TCP by default, then allows and adds the connection to Review, or blocks it if you choose. Vallum’s online help is labelled for Vallum 4, so check the defaults in the version you install.
Consider the administration workflow
Outbound has sample device profiles, a feed of up to 50,000 managed rules, optional pinning and 30 days of local audit logs. Managed exports can feed a collector. Neither vendor states MDM tools for Vallum or Murus; older Murus manuals describe the system pfctl tool and copying setups with Murus Pro Vials and Injector. Read the IT page before deciding those features match your environment.
Migration notes and editions
Vallum rules follow pf matching logic and a similar syntax, so plan to re-create them in Outbound by hand and test them. Check included utilities, upgrade terms and taxes for the exact edition you compare. Outbound’s personal licence includes all 1.x and 2.x updates. Its public release and tested compatibility results are still pending.
A note on fairness
Outbound wrote this page and is one of the products compared. Murus and Vallum cover network-layer and inbound jobs that Outbound does not try to cover, and that is a real reason to choose them.
For the packet-filter distinction, see the Murus product overview.
Before you switch
- Export your existing policy for reference.
- Choose a small set of essential app connections and re-create them in the new product.
- Test on your macOS build, with your VPN and required management software.
- Keep the old policy and removal instructions available until you have tested the new setup.