LuLu

What it is

LuLu is a host-based firewall for the Mac, built by Objective-See. It watches for outbound network connections and asks you whether to allow or block each new one. It is free and open source under GPL-3.0.

What it helps with

- Blocking unknown outgoing connections from apps and background processes
- Spotting malware that tries to phone home or exfiltrate data
- Building allow and block rules per process from its alerts
- Keeping Apple and already installed programs working by default, so you are not flooded with alerts on day one

Who it's for

Mac users who want control over what leaves their machine, including privacy-minded people, security researchers, and IT teams hardening macOS endpoints.

Worth knowing

Each alert shows the process making the connection and where it is trying to connect. LuLu needs you to approve its network extension in macOS settings during install. Objective-See funds its tools through Patreon.

Does LuLu block incoming connections?
No, LuLu focuses on outgoing connections, and macOS has its own built-in firewall for incoming traffic.

What happens when I click Allow or Block?
By default LuLu saves a general rule for that process, so it will always allow or always block it from then on.

How does it relate to Wireshark, Zeek and Suricata?
In our view those are network analysis and detection tools for watching traffic, while LuLu is a per-Mac firewall that stops unwanted connections before they leave.