What is LuLu?
LuLu is an outgoing firewall for macOS: it watches for new connections leaving your Mac and asks you what to do about them. That is the gap it was built to fill, because Apple's built-in firewall only handles incoming connections. Every alert shows the process and the destination, with block and allow buttons, and expands to include the code-signing information, the process hierarchy and a VirusTotal lookup. Rules can be scoped to a whole process or to a single remote endpoint, and given a lifetime — always, until the process exits, or until a set time. Allow and block lists can override the rules entirely. It is free, open source, macOS 10.15 or later, and it bundles a network monitor.
Verified product facts
- Type
- firewallEditorially reviewed
- Platform
- macOS
- Pricing
- Open sourceDeveloper-stated
- Open source
- Yes
- Developer
- Objective-SeeDeveloper-stated
- Relationship to Nuanyue
- Third-party product — not published by NuanyueEditorially reviewed
- Licence
- GPL-3.0
- Current version
- 4.5.1Developer-stated
- Official website
- objective-see.com/products/lulu.html
Last updated . Facts marked developer-stated come from the developer and are not independently confirmed; editorially reviewed marks a Nuanyue judgement.
Key features
What LuLu does at a glance.
Alerts whenever a new or unauthorized outgoing connection is created
Alerts show the process name and destination
With block and allow actions
Alert details include code-signing information, the process hierarchy and a VirusTotal lookup
Rules grouped as All, Default, Apple, 3rd-party program, User and Recent
Rule scope
The entire process, or only the remote endpoint
Rule duration
Always, for the lifetime of the process, or expiring at a set time
Rules can be added, edited, deleted, imported and exported, with regex support for addresses and domains and * for any
Allow and Block lists
Supersede rules, loaded from a local file or a remote URL
Profiles
Bundle a set of rules and settings and can be switched at once
Passive mode
Runs silently and applies existing rules without prompting
Block mode
Blocks all routed traffic
Options to hide the menu bar icon and to disable VirusTotal lookups
Bundles Netiquette, Objective-See's network monitor
Starts automatically
At login once configured
What you can use LuLu for
- Finding out when an application you installed starts phoning home
- Stopping one process from reaching the network while leaving everything else alone
- Switching between a permissive profile at home and a strict one elsewhere
- Checking whether a process that just connected out is signed, and what it is
Who is LuLu for?
- Mac users who want an outgoing firewall without paying for one
- Anyone who wants to know which processes on their Mac are making network connections
Who is LuLu not for?
- Anyone who needs long-term traffic history and per-connection reporting, which a network monitor provides and a firewall does not
- People who do not want to answer connection prompts at all
Limitations
- macOS only; there is no Windows or Linux version
- It covers outgoing connections only. Apple's built-in firewall is what handles incoming ones, so the two are complements rather than alternatives
- Answering a prompt for each new connection is intrusive until rules have accumulated
- Only rules you created yourself can be exported
- Whether the current release is a universal binary is not stated in the sources Nuanyue tracks; Objective-See publishes a single disk image for macOS 10.15 and later
- By default it contacts Objective-See.org on startup to check for a new version; the vendor states that no user or product information is collected or transmitted, and the check can be disabled
Strengths and trade-offs
What LuLu does well, and what to weigh before choosing it. Points marked developer-stated come from the developer’s own material and have not been independently confirmed.
Strengths
- Alerts on every new or unauthorized outgoing connection, showing the process and the destination with block and allow actions.Developer-stated
- Alert details include code-signing information, the process hierarchy and a VirusTotal lookup button.Developer-stated
- Rules can be scoped to an entire process or to just the remote endpoint, and given a duration of always, the process lifetime, or a set expiry.Developer-stated
- Allow and Block lists supersede individual rules and can be loaded from a local file or a remote URL.Developer-stated
- Profiles bundle a set of rules and settings that can be switched in one step.Developer-stated
- A Passive mode runs silently and applies existing rules without prompting, and a Block mode blocks all routed traffic.Developer-stated
- Free and open source under the GPL-3.0, with a signed disk image distributed directly and a published SHA-256 hash.
- Requires macOS 10.15 or later, and starts automatically at login once configured.
- Bundles Netiquette, Objective-See's network monitor, so you can watch traffic as well as control it.Developer-stated
Trade-offs
- macOS only — there is no build for other platforms.
- It covers outgoing connections only; Apple's built-in firewall is what blocks incoming ones.Developer-stated
- Until rules have accumulated, answering a prompt for each new connection is intrusive.Derived
- By default it contacts Objective-See.org at startup to check for updates, though the vendor states no user or product information is collected or transmitted and the check can be turned off.
- Only rules the user created can be exported; the built-in rule sets cannot.Developer-stated
First-use experience
What the app asks of you when you set it up. Only established facts appear here; anything we could not confirm is left out rather than guessed at.
- Installation
- Downloaded as a disk image from the project's GitHub releases, or from the vendor's product page, which also publishes a SHA-256 hash for the image.
- First launch Developer-stated
- LuLu asks for the permissions it needs to filter connections, then begins raising alerts as applications attempt to connect out. Once configured it starts automatically each time you log in.
- System integration Developer-stated
- Runs as a background firewall filtering outgoing traffic from every process, with a menu bar item for status and settings.
What it does
LuLu watches the connections leaving your Mac and asks you what to do about them. The vendor frames the problem directly: nearly every application makes network connections, and so does malware. Apple’s built-in firewall only blocks incoming connections, so nothing in the system asks whether an outgoing connection should be allowed. LuLu exists to be that something — it alerts you whenever a new or unauthorized outgoing connection is created, which could be an application you just installed or something that infected the machine without your knowledge.
Each alert names the process and the destination and offers block or allow. The detail view is where the security work happens: it shows the code-signing information for the process, the process hierarchy that spawned it, and a button that opens a VirusTotal lookup for the destination in your browser. That combination is what lets you answer the alert rather than guess at it.
Rules, lists and profiles
Rules are created from alerts, or by hand, and are grouped as All, Default, Apple,
3rd-party program, User and Recent. Two settings make them more precise than a
simple allow or deny. Rule Scope decides whether the rule applies to the whole
process or only to the remote endpoint, and Rule Duration decides whether it lasts
always, for the lifetime of the process, or until a time you set. Rules support
regular expressions for the remote address or domain, with * standing for any,
and they can be exported and imported — though only the rules you created yourself
can be exported.
Above the rules sit Allow and Block lists, which supersede them, and which can be loaded from a local file or fetched from a remote URL. Profiles, added in version 4.0, bundle a set of rules and settings so a whole configuration can be switched in one step. For times when you do not want to be asked, Passive mode runs silently and applies the existing rules; Block mode simply blocks all routed traffic.
Traffic, updates and licensing
LuLu bundles Netiquette, an Objective-See network monitor packaged into the application, so the same install can both control and show traffic — though the monitor is the smaller half of the product and does not replace a dedicated tool.
Two things are worth knowing before installing. By default LuLu contacts Objective-See.org on startup to check whether a newer version exists; the vendor states that no user or product information is collected or transmitted, and the check can be disabled. And the application is macOS-only — there is no build for any other platform.
LuLu is free and open source under the GPL-3.0, with no paid tier. The current release is v4.5.1, for macOS 10.15 and later, distributed as a signed disk image with a published SHA-256 hash so the download can be verified. Once configured it starts automatically each time you log in. Whether the current release is a universal binary is not stated in the sources Nuanyue tracks, so it is recorded here as unknown rather than assumed.
Questions about LuLu
Is LuLu free?
Yes. The vendor describes it as a free, open-source firewall, and the source is published under the GPL-3.0. There is no paid tier and no account; the disk image is distributed directly with a published SHA-256 hash, and donations fund the work.
How is LuLu different from the firewall built into macOS?
Apple's built-in firewall only blocks incoming connections. LuLu is designed to detect and block unauthorized outgoing connections — for example when malware tries to reach its command and control server or to exfiltrate data — so it addresses a different direction of traffic rather than replacing the system firewall.Developer-stated
Which macOS versions does LuLu support?
The current release, v4.5.1, is published for macOS 10.15 and later. The vendor also lists a SHA-256 hash for the disk image so the download can be verified.
Can LuLu show me what my network traffic looks like?
Partly. LuLu is a firewall rather than a monitor, but it bundles Netiquette — an Objective-See network monitor packaged into LuLu — which you can launch from the application to see traffic.Developer-stated
Does LuLu send any data about me?
The vendor states that when LuLu starts it connects to Objective-See.org to check whether a new version exists, and that no user or product information is collected or transmitted. The check can be turned off with the 'Disable Update Checks' option.
Alternatives to LuLu
Apps that could replace this one — the same job, a different trade-off.
Little Snitch
Application firewall that approves or blocks every outgoing connection.
Both are outgoing firewalls for macOS that ask before an app connects, but LuLu is free and open source while Little Snitch is a paid, closed-source product with rule groups, long-term traffic history and built-in DNS encryption.
Similar apps
Related in purpose, but not a straight swap.
PureSnitch
Open-source application firewall with a Little Snitch-style world map, rule manager, DNS over HTTPS, and pf-based blocking, with no telemet…
Both are open-source outgoing firewalls for macOS, but LuLu comes from Objective-See with VirusTotal lookups and profiles, while PureSnitch builds its interface around a Little Snitch-style world map and pf-based blocking.
Works well with
Not a replacement — apps commonly used alongside this one.
BlockBlock
Me: "Please alert me whenever anything is persistently installed." BlockBlock: "You got it"
Both are Objective-See security tools that watch different things: BlockBlock alerts you when software installs itself to persist, and LuLu then decides what that software is allowed to do on the network.
Links
Sources
Facts on this page are checked against the sources below. Last updated .
- LuLu — official websiteGrade B
- Objective-See — developer websiteGrade B
- LuLu — source repositoryGrade D
