Outbound's Connections settings

A firewall that watches traffic should show its own. The Outbound’s Connections page lists every connection Outbound itself opens: what it is for, which server it uses, when it happens, and the setting that turns it off. A footer under the list reads “Outbound labels its own traffic in the Network Monitor too.”, so you can watch these connections like any other in Network Monitor.

Reading a row

Each row shows the connection’s name, its current state on the right, a sentence on what it does, the hosts it uses where they are fixed, when the connection happens, and the setting that stops it. Where a settings page owns the switch, the row ends with Open and that page’s name. Problem reports, the managed rule feed and the dictation model have no such button. Open Licence is hidden when the Licence page is absent, and Open DNS Settings is hidden when the DNS page is absent.

The states are:

• On: the connection happens under the current settings.
• Off: it does not happen.
• Only when you use it: nothing runs on its own; the connection waits for you to do something.

App updates

“Checks for a new version of Outbound and downloads the update named in the signed feed.” It talks to outboundfirewall.com. The row says: “Once a day while automatic checks are on, and when you choose Check for Updates. The check reads the feed on outboundfirewall.com. The update file’s address is the one in that feed.” Off with: “Settings › Updates › Check for updates automatically” (button: Open Updates).

State: Off in a copy that cannot update itself; On while automatic checks are on; otherwise Only when you use it.

Problem reports

“Sends the report you write, and only the parts you choose to include.” It talks to outboundfirewall.com, and only when you send a report from Help › Report a Problem. It has no off switch, because it never acts on its own. State: Only when you use it. See Report a problem.

Blocklists

“Downloads host lists you add, and refreshes them on a schedule.” The host is the https address of a list you add in Settings › Blocklists, or the ads list you turn on during setup. The background agent fetches each list when you add it and again when its refresh interval is due; it looks about once a minute. Off with: “Remove the list in Settings › Blocklists” (button: Open Blocklists).

State: Off until you have a list, then On. See Blocklists settings.

Managed rule feed

“Downloads the rules your administrator configures for this Mac.” The address is the RuleFeedURL preference your administrator sets. Outbound fetches the feed at launch and about every six hours while that preference is set. The only way to stop it is the administrator’s: “Your administrator removes RuleFeedURL”. There is no Open button. State: On while the feed is configured, Off otherwise. See Managed rule feed.

Location database

“Downloads the offline city database that places connections on the map.” It talks to download.db-ip.com. While automatic updates are on, Outbound downloads the database when it is missing and again when a newer month is published; you can also install it by hand from Settings › Monitor. Off with: “Settings › Monitor › Update the location database automatically” (button: Open Monitor).

State: On while automatic updates are on (they are on by default); otherwise Only when you use it, for a manual install. See Monitor.

Website icons

“Asks a site for its icon so Outbound can show it.” The host is a site shown in Outbound. A fetch runs only when Download icons from websites is on, and only for a connection that is already allowed. Icons that ship with the app need no network. Off with: “Settings › Appearance › Download icons from websites” (button: Open Appearance).

The row is On only when both switches are on: Show website icons (on by default) and Download icons from websites (off by default). Either one off and the row reads Off. See Appearance.

Assistant

“Sends figures to the AI service you choose so it can write an overview.” The row names the built-in services as api.openai.com, api.anthropic.com, generativelanguage.googleapis.com and openrouter.ai, and its trigger names them OpenAI, Anthropic, Google Gemini, or OpenRouter. A custom server, such as Ollama or LM Studio, uses the address you enter instead. This happens after you choose a provider, add a key, and turn on Send figures to. Test Connection sends one request when you press it. Off with: “Settings › Intelligence › Send figures to” (button: Open Intelligence).

State: Off until a provider is chosen and, where that provider needs one, its key is in place. On once that provider is approved. Only when you use it while it is ready but Send figures to is off, because Test Connection can still send. See Intelligence and Providers and what is sent.

Crash reports and usage

“Sends anonymous crash reports and a short list of usage events.” The hosts listed on the row are us.i.posthog.com and ingest.us.sentry.io. The row’s own account of when it connects is:

“Only while Share anonymous crash reports and usage is on. Usage events go to us.i.posthog.com when the build has a PostHog key. Crash reports go to the host in the build’s Sentry DSN. A US project’s host is an organization name under ingest.us.sentry.io. The DSN checked into this tree is empty, so this copy sends no crash report until a DSN is set.”

Off with: “Settings › General › Share anonymous crash reports and usage” (button: Open General). State follows that switch, which is off unless you turn it on. See General.

License

“Activates a license key and checks that it is still valid.” It talks to live.dodopayments.com when you activate or deactivate a key, and when a saved key is due for a check: Outbound looks about every six hours and contacts the server if the last successful check was more than seven days ago. Off with: “Deactivate the key in Settings › License” (button: Open License, when the License page is in the sidebar).

State: On while a key is activated on this Mac; otherwise Only when you use it. See License.

Encrypted DNS

“Sends lookups made through macOS’s resolver to the provider you choose.” The hosts listed are dns.quad9.net, cloudflare-dns.com, dns.google and dns.nextdns.io. When Encrypt DNS lookups is on, macOS uses the resolver you picked, over HTTPS or TLS. NextDNS uses your profile ID on dns.nextdns.io, and a custom resolver uses the address you enter. The row also says that apps with their own resolvers and VPNs may bypass this setting. Outbound itself sends A and AAAA test lookups over HTTPS or TLS when you run Test, even when encryption is off. Off with: “Settings › DNS › Encrypt DNS lookups” (button: Open DNS Settings, when the DNS page is in the sidebar).

State: On while encrypted DNS is active. When a DNS configuration exists but isn’t active, for example while macOS waits for your approval in System Settings, the row reads Only when you use it, because the DNS test can still connect. With no DNS configuration it reads Off. Whether lookups are verified as encrypted is shown on the DNS page itself.

Dictation model

“Downloads Apple’s speech model for your language so dictation can run on this Mac.” This happens the first time you dictate a question in a language whose model is not installed yet; Apple chooses the server, so no host is listed. Speech is then recognised on this Mac. There is no off switch and no Open button: the download belongs to macOS. State: Only when you use it.

Coding agents

“Starts a coding agent on this Mac so the Assistant can ask it about your network.” When you choose Claude Code or Codex and agree to use it, or press Test, Outbound runs npx, which can download the agent adapter the first time; the registry address is whichever npm is set to use. Other agents are programs already on this Mac. Off with: “Settings › Intelligence › Answered by” (button: Open Intelligence).

State: Off until an agent is chosen, then Only when you use it, because choosing an agent is enough to let a Test run start it. See AI apps and MCP.