What is Outbound?
Outbound is a firewall for the connections your Mac makes out to the internet, and this page says what it is and what runs where.
Outbound is an outbound application firewall for Mac. It watches the connections your apps make out to the internet and decides, app by app, whether each one goes through. A rule can allow or block a program, a website or a whole network; anything no rule decides can be brought to you as a question before it connects.
It is for people who want to know which programs on their Mac talk to which servers, and who want to stop the ones they do not want. If you also look after other people’s Macs, the administration chapters cover managed preferences, a rule feed and audit export.
How it differs from the macOS firewall
Section titled “How it differs from the macOS firewall”The firewall built into macOS filters incoming connections. Outbound works the other way round: it filters the connections your Mac makes out.
What runs on your Mac
Section titled “What runs on your Mac”Outbound is four things:
- The app. The window you open from the Dock or the menu bar: the Network Monitor, rules, Review, blocklists, profiles and Settings all live here. See the main window.
- The background agent. A small part of Outbound that starts when you log in. It asks you about new connections and keeps the menu bar item while the Outbound window is closed. macOS lists it under System Settings › General › Login Items & Extensions.
- The network filter. A system extension that runs inside macOS. It sees each new connection, says which app made it and where it is going, and applies your rules before the connection goes through. It uses a macOS content filter, not a DNS proxy. Only when you give an app a speed limit, the same extension also runs a transparent proxy for that app, which forwards its traffic at the rate you set.
outboundctl. The command line tool for reading and changing rules and settings from a terminal or a script. See outboundctl.
What it sees, and what stays on your Mac
Section titled “What it sees, and what stays on your Mac”Outbound decides from who is connecting and where: the app making each connection, who signed it, the server’s name and address, the port, and how much data went each way. It never reads what is inside a connection. Pages, messages, files and passwords pass through untouched and unread, including for an app with a speed limit, whose traffic Outbound forwards without reading, logging or keeping it.
Your rules, preferences, profiles and connection history are stored on your Mac. Connection history is encrypted there, with its key in your Keychain; see Where Outbound keeps its data. Optional cloud summaries can send analytics figures to a model you configure and enable. Review those controls in Intelligence and Outbound’s Connections. See Permissions for the full picture.
What it costs
Section titled “What it costs”Outbound is a paid app with a one-time licence: a Personal licence covers 2 Macs and a Family licence covers 5. There is no trial. See Trial and licence.
Requirements
Section titled “Requirements”Outbound needs macOS 14 or later, on Apple silicon or Intel. See Installing Outbound for the download and the setup steps.