Choosing what to allow
The alert's Remember, Applies to, and Port pickers, and the rule each combination creates.
An answer can cover one connection, or become a rule that decides the same question later. Two pickers set that: Remember (how long) and Applies to (how far). A Port row appears for a connection that has a service port, once the destination is narrower than Any server and the answer can be remembered. The labels on the alert are not the same words as the matching controls in Settings.
Remember: how long the answer lasts
Section titled “Remember: how long the answer lasts”The Remember picker offers:
- Once: this connection only. Nothing is stored, and the next connection asks again.
- For 5 Minutes, For 15 Minutes, For 30 Minutes, For 1 Hour, For 1 Day or For 1 Week: a rule that expires that long from now.
- Until Quit: a rule that lasts while the program runs. When it quits, the rule is gone.
- Until Logout
- Until Restart
- Forever: a permanent rule.
⌘1 is Once, ⌘2 is For 1 Hour, ⌘3 is Until Quit, and ⌘4 is Forever. ⌘1 works even when a remembered answer is impossible. ⌘2, ⌘3, and ⌘4 change the picker only when the answer can be stored. The help on the picker lists the same four keys.
What each lifetime means everywhere else is in Temporary rules and lifetimes.
Applies to: how far the answer reaches
Section titled “Applies to: how far the answer reaches”The Applies to picker offers only choices that mean something for this connection:
- Any server: every server the program talks to.
- The local network: every device on your local network. Offered when the server’s address is on it, and not for a program’s own DNS lookup.
- Network: the /24 network (IPv4) or /64 network (IPv6) around the server’s address, shown under the picker, such as 203.0.113.0/24. Not offered for a program’s own DNS lookup.
- This domain: the server and every server under its domain. The line under the picker reads “Only domain example.com”, and the rule is stored as *.example.com. This choice is omitted when there is no host name, and for a program’s own DNS lookup.
- This host: that server, shown as “Only example.com”. When the connection has an address and no host name, the choice is This address, shown as “Only address 203.0.113.7”.
- For a program’s own name lookup, the line under the picker reads “DNS lookups via (server)”. The answer decides which name server that program may ask.
When there is neither a host name nor an address, the picker is disabled and the answer applies to this connection only.
Port and protocol
Section titled “Port and protocol”When Applies to is anything narrower than Any server, the answer can be remembered, and the connection has a service port, a Port row offers:
- Only 443 (TCP): the port and protocol of this connection. The protocol in parentheses is omitted when it is unknown.
- Any port (TCP): every port, this protocol only.
- Any port or protocol: only when the protocol is known.
The row is disabled while Remember is Once. With Any server chosen, there is no port row: a rule for every destination already covers every port.
The preview under the pickers says what you are about to store. An exact port does not add “on any port”. Choosing Any port does. A domain reads “every server under example.com”. Forever reads “from now on”. For 1 Hour reads “for the next hour”, and the other timed choices read the same way. Until the app quits, until you log out, and until this Mac restarts are spelled out the same way. A profile limit adds “, while (Profile) is active”.
Only while a profile is active
Section titled “Only while a profile is active”When a profile is active and the answer can be remembered, a checkbox sits under Remember: Only while (Profile) is active. It starts unticked unless you change Default profile scope in Settings › Alerts. Unticked, the rule applies in every profile. Ticked, it applies only while that profile is active. The box is disabled while Remember is Once. Its help says the same thing.
What you cannot widen
Section titled “What you cannot widen”Two cases offer Once only. The Remember picker is disabled, and a line says why:
- “Outbound can’t tell which program this is, so the answer applies to this connection only.” The caption under it: “This program can’t be identified, so your answer applies once.”
- “Outbound doesn’t know where this connection was going, so the answer applies to this connection only.”
- “This copy runs from a temporary location, so your answer applies once.” macOS runs a downloaded app from a temporary location until you move it, for example to Applications, and that location changes every launch.
The preview then says “This one connection goes through.” or “This one connection is stopped.”
A note on the rule
Section titled “A note on the rule”The pencil in the header opens Note, saved with the rule. The field is disabled for Once, and its help then says an answer for this connection only creates no rule to note. A note you type replaces the factory note. Leave the field empty and the rule is stored as “Created from alert”.
What a new alert starts with
Section titled “What a new alert starts with”A new alert starts where Settings › Alerts left the defaults, as long as this connection can be remembered:
- Alerts start with sets Remember. With nothing stored, that is Forever. When it is a timed choice, Default duration picks the length, 1 hour unless you change it.
- Applying to sets Applies to. With nothing stored, that is Only that server (the host). The other Settings choices are Its whole domain and Any connection. A domain default is pulled back to the host when this connection has no host name, or when it is a DNS lookup.
- Default profile scope sets the Only while (Profile) is active box. With nothing stored, it starts unticked.
- Default port and protocol sets the Port row. With nothing stored, that is this port and protocol.
If the connection cannot be remembered, Remember starts on Once whatever the setting says. See Alerts settings.