Creating and editing rules

The rule editor is a sheet: what to do, which program, where, and for how long. Open it with Add Rule in the Rules pane, by double-clicking a rule, or with Edit… in its menu. A new rule starts as Block. Each field shows its own prompt.

Describe it

A new rule starts with Describe it. The placeholder is “Block Chrome from google-analytics.com”. Type a sentence and click Fill In. While it reads the apps on this Mac the button says “Reading apps…”. The line under the field is “Write the rule as a sentence; the fields below fill in for you to check.” Nothing is saved until you save the form.

Example data.

When the sentence fills in, the sheet says “Filled in. Check the fields, then save.” A duration in the sentence becomes For 1 hour when it is an hour or less, For 1 day when it is a day or less, and Forever otherwise. If that duration was not exactly one hour or exactly one day, the note says the duration was rounded, names the choice in lowercase (“for 1 hour”, “for 1 day”, or “forever”), and asks you to check the fields.

It refuses a sentence it cannot read:

• “Start with what to do: block, allow or ask.”
• “No installed app is called “(name)”. Use the app’s name as it appears in Applications.”
• “Say where: “from example.com”, “to *.example.com” or “to anywhere”.”

Editing an existing rule does not show this field.

Action

Action is a segmented control: Allow, Block, Ask. Ask means a connection that matches this rule is asked about. See Rules.

App

Applies to offers three kinds of program. The sheet keeps only the kind you picked.

• Any app: every program.
• A signed app: a signing identifier. The prompt is “com.example.app”. Team ID is optional (its prompt is “optional”). Choose App… reads the identifier and team from a bundle you pick. With no team ID, a signing identifier that is not Apple’s is stored as a path when a path is known, so the rule still matches that build.
• A program by path: an executable path. The prompt is “/usr/bin/curl”. Choose Program… picks the file.

The open panel starts in /Applications. For a signed app it offers application bundles. For a path it offers any file. An empty signing identifier says “Enter the app’s signing identifier.” An empty path says “Enter the path of the program.”

Destination

Destination chooses between Address or name and Countries.

• Remote: where the connection goes. The prompt is “any, *.example.com, 10.0.0.0/8”. Accepted values are any, local, a domain written *.example.com (that server and its subdomains), a host name, an IP address, or a network such as 10.0.0.0/8. A value it cannot read says: “Use any, local, *.example.com, an IP address, a network such as 10.0.0.0/8, or a host name.”
• Ports: the prompt is “any, 443, 80, 443, 8000-8100”. Accepted values are any, one port (443), a list (80, 443), a range (8000-8100), or a mix. Ports run from 1 to 65535, and a range runs from the low number to the high one. A value it cannot read says: “Use any, a port (443), a list (80, 443), a range (8000-8100) or a mix. Ports are 1 to 65535.”
• Protocol: Any, TCP, UDP, or ICMP.
• Direction: Outgoing, Incoming, or Either.

With Countries, the rule decides by the country of the server. Choose… opens a list of countries to pick from. For a block rule the choices are Block these countries and Only allow these countries; for an allow rule they are Allow these countries and Allow every country except these. A country rule cannot ask, so choosing Countries while the action is Ask switches it to Block. With no country chosen the sheet says “Choose at least one country.” A country rule leaves servers on your local network, and servers whose country is not known, to your other rules.

An editor opened on an incoming connection that has no local port starts with the port to be typed. Allow or Ask cannot be saved while Ports is any, because that would cover every local port. Block may stay any, because that only blocks more. The same ports message is what the field shows.

Options

• Lasts: how long the rule lives. The choices are Forever, For 1 hour, For 1 day, Until logout, Until restart, and On a schedule…. When you edit a rule whose lifetime is not Forever, the picker also offers Keep current with the current lifetime in words, for example “Keep current (Until quit)”. A lifetime the sheet cannot set right now says “This lifetime cannot be set right now. Choose another.” See Temporary rules and lifetimes.
• The schedule, when Lasts is On a schedule…. Seven buttons, Monday through Sunday, labelled with the short weekday symbols and with the full weekday name for accessibility. From and To pick the times. Presets fills in one of three ranges: weekdays from 9:00 to 17:00, school nights from 21:00 to 07:00 (Sunday through Thursday), or every night from 00:00 to 06:00. With no day selected the sheet says “Choose at least one day.” When From and To are the same time it says “All day on the selected days.” When From is later than To it says “Ends the following morning. Select the nights it starts.” Otherwise it says “Uses this Mac’s local time.”
• Profile: shown only when you already have at least one profile. All profiles, or one profile by name. A rule in a profile applies only while that profile is active.
• Priority rule, with “Wins over rules without priority that match the same connection. Between two priority rules, the more specific one wins.”
• Note: any text you want kept with the rule.

Example data.

Notification and Sound

An allow or block rule can tell you when it decides a connection:

• Show a notification: posts a notification each time the rule decides.
• Play a sound: None, or one of the system sounds. Choosing a sound plays it once so you can hear it.

The footer says “These only tell you: the rule decides the same way with or without them. At most one notification per rule each minute; more connections are counted into the next one.” An Ask rule shows an alert instead, so the section is unavailable while the action is Ask. Notifications for rules need Rules set to notify on in Settings › Notifications and Outbound allowed to notify in System Settings.

Saving

Cancel and Add (a new rule) or Save (an existing one) sit at the bottom. While the save runs the button says “Saving…” and ignores further clicks. If the fields do not make a rule, the sheet says “Check the highlighted fields.” If Outbound refuses the save, the error stays on the sheet and the draft stays as you typed it. Edit › Undo takes back a save that did go through.

When an edit would make the rule identical to rules you already have, the sheet says “This edit makes N rules identical” and offers Merge or Go Back. Merge keeps one rule: the oldest, with your edit and the notes of all of them. Go Back returns to the form without saving.

Saving an existing rule keeps what the form does not edit: its source, whether it is on, when it was created, and a helper process attached to the original rule. Priority and profile come from the controls above.