Local network traffic
Which addresses count as your local network, how to add ranges, and how loopback is treated.
Outbound treats these address ranges as your local network, on every Mac:
10.0.0.0/8172.16.0.0/12192.168.0.0/16169.254.0.0/16(link-local)127.0.0.0/8(loopback)::1/128(IPv6 loopback)fe80::/10(IPv6 link-local)fc00::/7(IPv6 unique local)
A rule with the Local network destination matches all of them, plus any extra ranges you add, and so does the Local network trusted group. Addresses outside these ranges are internet addresses as far as rules are concerned.
Extra ranges
Section titled “Extra ranges”Settings › Advanced, under Local Network, can add further CIDR ranges. The field prompt is “CIDR, e.g. 10.20.0.0/16”. That particular example already sits inside 10.0.0.0/8, so adding it does not enlarge the local network. A range that is not already covered, such as a corporate block outside the private ranges above, does. Each added range has a Remove button. The same list is the extra-local-ranges preference, comma-separated, in outboundctl prefs set.
The footer: “Addresses in these ranges count as your local network, besides the standard private ranges. Adding a range to a Local network allow rule loosens protection, so it asks for approval.”
A mistyped range is refused with “Invalid local-network range ‘range’. Enter an IPv4 or IPv6 CIDR, such as 192.168.0.0/16.” The quotes around the value are straight single quotes. The example in that sentence is also inside the built-in 192.168.0.0/16. It shows the shape Outbound wants, not a range you need to add.
Loopback
Section titled “Loopback”Connections to this Mac itself (127.0.0.0/8, ::1, or the name localhost) are a special case. macOS hands them to the filter only while an enabled rule names a loopback destination, and then only such a rule decides them. Anywhere and Local network do not name loopback for this purpose, so the default Local network group leaves local development servers alone. Strict does not block a local dev server, and Ask does not ask about it, unless you wrote a rule that names loopback itself.
Counting local traffic in the menu bar
Section titled “Counting local traffic in the menu bar”The preference count-local-traffic is off by default (outboundctl prefs set count-local-traffic true). It is remembered. In this version the menu bar sampler cannot tell local bytes from internet bytes, so the meter always counts both and the preference changes nothing.