Operation modes
What Learn, Ask and Strict do with an unknown connection, and how each control switches between them.
Outbound has three modes. A mode is the default answer for a connection that no rule covers. Your rules apply in every mode, so the mode only decides what nothing else has decided.
In Learn, unknown connections are allowed and recorded for you to review. Your rules still apply. What Learn allowed lands in Review.
The one-line description under the main window’s mode control, and in the menu bar, is “Unknown connections are allowed and recorded for review.” Settings uses a longer line: “Unknown connections are allowed and recorded for you to review. Your rules still apply.”
Leaving Learn for Ask from the main window’s mode control asks whether to keep that record:
Keep what Learn recorded?
Keeping turns the connections Learn allowed into rules, so apps you already use don’t alert. Without keeping, each app alerts the first time it connects.
Cancel stays in Learn. Use Ask Without Keeping switches to Ask and drops the record. Keep and Use Ask turns the allowed connections into rules, then switches. Choosing Strict from that control switches at once and does not ask.
The menu bar, Firewall › Mode, and Settings › When an app connects switch straight away and do not ask this question. On the Overview, while Learn is still in force, Use Ask appears when Learn has recorded nothing, and Keep and Use Ask appears once it has seen apps.
In Ask, Outbound asks before an app makes a new kind of connection. Settings puts it as “Outbound asks before an app makes a new kind of connection. One window, one app at a time.” The menu bar’s one-liner is “Outbound asks you about each unknown connection.”
The connection alert names the app and the server. How long the answer lasts is the alert’s Remember choice: once, for an hour, until that app quits, until logout, until restart, or forever. See Temporary rules and lifetimes.
An alert does not wait forever. A TCP connection waits for the time set in Settings › Alerts (15 to 120 seconds, 60 by default). A UDP connection gets 8 seconds. After that the filter applies your “If I do not answer” choice once and adds the connection to Review. The settings line says Strict always blocks, and in Strict the “If I do not answer” and “While the background agent is not running” pickers are off.
Strict
Section titled “Strict”In Strict, unknown connections are blocked and recorded in Review. Your rules still apply. VPN apps you have installed stay connected; turn that off in Trusted. The menu bar’s one-liner is “Unknown connections are blocked and recorded for review. VPN apps you have installed stay connected; turn this off in Trusted.”
The first block of each app can post one notification, “Outbound blocked App”, with the line “Strict mode blocks apps you haven’t allowed.” You get at most one per app per hour, and only while Settings › Notifications › “Connections waiting in Review” is on. An app that an overload notice has just named, within the last minute, does not get a second notice for that burst. The notification offers Allow App and Review. Allow makes an allow rule for any destination. If that app still has an alert open, the duration is the Remember choice on that alert, or once when a rule cannot be saved. If nothing of that app is waiting, the duration is whatever Settings › Alerts has under “Alerts start with” (Forever unless you changed it).
Switching modes
Section titled “Switching modes”- The main window’s mode control offers Learn, Ask and Strict, with the one-line description under it.
- The menu bar panel’s Mode section. The mode in force has a checkmark. A change still on its way reads “Mode · waiting for approval” or “Mode · not confirmed”.
- Firewall › Mode, with the same waiting and not-confirmed lines.
- Settings, as When an app connects. While the filter has not caught up, Settings adds “The filter has not confirmed this mode yet” or “The filter is still in Mode until this change is approved.”
Switching to a looser mode asks for Touch ID or your login password first. Looser means Strict to Ask, Strict to Learn, or Ask to Learn. The prompt names the change, for example “a looser mode (Strict to Ask)”. Tightening does not ask.
When your organization manages the mode, the controls are off. The main window reads “Your organization manages the mode on this Mac.” The menu bar reads “Your organization sets the mode”. Settings reads “This setting is managed by your organization.” A switch from inside the app answers “The mode is set by your organization.”
Switching from the command line
Section titled “Switching from the command line”outboundctl prefs get modeoutboundctl prefs set mode strictprefs get mode prints the mode as the filter stores it: alert (Ask), silentAllow (Learn) or silentDeny (Strict). prefs set mode accepts ask or alert, learn or silentallow, and strict or silentdeny, in upper or lower case. Anything else answers “mode must be ask, learn or strict”.
A loosening change is refused with “This change would loosen protection. Approve it in the Outbound app.” When your organization forces the mode, the command answers “mode is set by your organization and cannot be changed from outboundctl.” See outboundctl.