LuLu review: control outgoing connections on a Mac

LuLu is a free open-source macOS firewall for people who want a say in which programs on a Mac open new connections to the internet.¹² When an app tries to connect out and no rule covers it yet, LuLu asks you to allow or block that connection. That question is the privacy benefit: everyday apps often talk to their own servers, and software you did not expect to be online has to ask first.

Last checked October 28, 2026.

At a glance

What it is: A free open-source macOS firewall for new outgoing connections

Works on: macOS 10.15 and later¹

Price: Free¹

Licence: GPL-3.0²

Best for: Mac users who want to approve which apps connect out

Official site: objective-see.org/products/lulu.html

What LuLu does (and how it protects your privacy)

Applications on a Mac make network connections, and malicious software often does the same.¹ LuLu alerts you when a new outgoing connection has no rule yet, naming the program and the destination. By default, Block or Allow becomes a general rule for that program, so the question does not return every time.¹

Apple’s built-in firewall blocks incoming connections. LuLu is designed for unauthorized outgoing connections, including a program trying to reach a remote server.¹ Because LuLu only monitors outgoing traffic, its rules apply to outgoing connections.¹ Blocking an app stops that app from connecting. An allowed connection is still visible on the network you are using. What an internet provider can still see is a separate question from which app you allowed.

LuLu runs as a network filter on the Mac. Some network traffic is never routed through Apple’s network extensions, so LuLu never sees it and cannot block it.¹ For the traffic it does see, you decide which new programs may connect, and whether Apple’s own signed programs and software already on the Mac may connect without an alert.¹

Key features of the LuLu firewall

Connection alerts. A new outgoing connection shows the program, the destination, who signed it, and which process started it.¹
Narrow rules. A decision can cover the whole program or only that destination, and it can last forever, for that run, or until a time you set.¹
Quieter defaults. “Allow Apple Programs” allows software signed only by Apple. “Allow Installed Applications” allows programs already on the Mac.¹
Passive mode and block mode. Passive mode applies saved rules without alerts. Block mode blocks traffic that passes through LuLu, except destinations on an allow list.¹
Profiles. Since version 4.0, each profile keeps its own rules and settings.¹
Allow and block lists. A file on the Mac, or a web address, can list hosts and IP addresses. If both lists are set, the block list wins.¹
A rules window. You can add, edit, delete, export, and import rules. Signed apps are matched by their code-signing identifier, so a rule can follow an update.¹
Current connections. Network Monitor opens Netiquette, packaged inside LuLu. A VirusTotal button opens a browser page for a file hash, and only if you click it.¹

Pros and cons of LuLu

Pros

The download is free, and the source is public under GPL-3.0.¹²
It watches outgoing connections, the direction Apple’s built-in firewall does not cover.¹
Apple software and apps already installed can keep working while you review what is new.¹
The automatic version check can be turned off. The project states that it collects and transmits no user or product information.¹
Version 4.5.4 was published on 27 October 2026, and the GitHub repository is not archived.²³

Cons

The product page lists macOS 10.15 or later, so it is a Mac tool.¹
First launch asks you to approve a system extension and a network filter. The clicks vary slightly by macOS version.¹
A new outgoing connection with no rule raises an alert, so each unfamiliar program asks for a decision.¹
Traffic that never passes through Apple’s network extensions is invisible to LuLu and cannot be blocked there.¹
Host-name blocking applies to Network.framework or NSURLSession connections. For browsers such as Chrome, the documentation says only an IP address block works. Safari and Firefox can still be blocked by host name.¹
Rules cover outgoing connections. Incoming connections stay with other controls, including Apple’s firewall.¹

Is LuLu safe and private?

LuLu comes from the Objective-See Foundation, a non-profit focused on macOS security that develops free, open-source Mac security tools. Patrick Wardle, founder and co-director, is described as the creator of those tools.⁴ The public repository objective-see/LuLu licenses the firewall under GPL-3.0 and is not archived.²

When LuLu starts, it reads products.json on Objective-See.org to learn the latest version number. The project states that this check collects and transmits no user or product information, and that “Disable Update Checks” turns it off.¹ In version 4.5.4, “Check for Update” uses the latest GitHub release. The automatic check at launch still uses the website feed, which is updated once a release has been out for a while.³

VirusTotal, a site that scans a file with many antivirus engines, is optional. Nothing goes there unless you click the button, which opens a browser link containing the file’s hash. “No VirusTotal Mode” disables that button.¹ Rules stay on the Mac in separate files for each profile.¹ macOS asks you to approve a system extension before the filter can run.¹

How to get started with LuLu

Download the disk image from the LuLu page, or the release on GitHub. Version 4.5.4 was published on 27 October 2026.³ On 28 October 2026 the product page still offered 4.5.3. The project says the website feed is updated once a release has been out for a while.¹³
If LuLu is already running, choose “Quit LuLu” in the status bar first. Otherwise the copy fails because LuLu.app is in use.¹
Open the disk image, drag LuLu.app into Applications, and launch that copy.¹
Approve the system extension and network filter: click “Open System Settings”, turn LuLu on, authenticate, and click Allow. If it is missing, use Login Items and Extensions, then the info button on Network Extensions.¹
Leave the first-run defaults on if Apple programs and software already installed should keep their network access. Settings can change this later.¹
LuLu then starts at login and shows a status-bar icon, unless you hide it.¹ On an alert, allow or block. Rules, in the status bar, is where you edit that choice later.

Who should use LuLu (and who might prefer something else)

LuLu fits a Mac user who wants a free way to notice new outgoing connections and keep a simple allow or block list. It is a good match if you are happy to answer a prompt when you install something, and then let the saved rules handle ordinary use. The recommended defaults mean you do not have to approve every Apple process on day one.¹

On Linux, OpenSnitch reviews which applications connect. On Windows, simplewall sets application connection rules. On Android, NetGuard chooses which apps get internet access. If you want a Mac firewall with a history of connections, Little Snitch from Objective Development can show up to a year of past activity. Objective Development states that Little Snitch is not free software, and that it runs in a limited demo until you enter a licence key.⁵

Frequently asked questions

Is LuLu free?

Yes. Objective-See calls LuLu a free, open-source firewall, and the repository uses GPL-3.0.¹² The project also invites sponsorship of LuLu and the Objective-See Foundation.³

Is LuLu safe?

macOS asks you to approve its system extension before the filter can run.¹ The source is public under GPL-3.0, from a non-profit that publishes free Mac security tools.²⁴ The version check can be disabled, and the project says it carries no user or product information. VirusTotal runs only when you click its button.¹

Does LuLu work on iPhone or Windows?

The product page requires macOS 10.15 or later.¹ Windows and Android have other tools, linked above. LuLu stays on the Mac.

Do I need LuLu if the Mac firewall is already on?

The two tools watch different directions. Objective-See’s answer is yes if you want outgoing control: Apple’s built-in firewall blocks incoming connections, and LuLu is designed to detect and block unauthorized outgoing ones.¹ Leaving Apple’s firewall on still covers the incoming side, which LuLu’s rules do not.