Little Snitch vs LuLu vs Radio Silence vs NetMute: Which Mac Firewall Is Right for You?

Most Mac users assume their computer is protected out of the box, and in many ways macOS is genuinely secure. But there is a blind spot: outgoing connections.

The built-in macOS firewall controls incoming connections, which keeps outsiders from reaching services on your Mac, especially on public Wi-Fi. It does nothing about what your apps send out. Every app you install can contact any server, including analytics, advertising and telemetry endpoints, without asking you.

What that looks like in practice: on the developer's own Mac, between 7 and 22 September 2026, GeForce NOW contacted 59 domains. Two of them were tracking endpoints (feedbacks.telemetry.data.nvidia.com and events.telemetry.data.nvidia.com). Over 30 days on the same Mac, NetMute stopped 2,701 tracker requests from 64 companies across 33 apps. The built-in firewall does not look at any of that.

An outgoing firewall watches the connections your apps try to make and lets you allow or block them. This is not about paranoia but about informed consent: you should know what your apps do on the network, and you should be able to say no.

The four tools here take different approaches. Little Snitch gives you detailed, rule-based control per connection. LuLu gives you free, open-source allow/block decisions. Radio Silence blocks whole apps without prompts and shows you a live connection list. NetMute combines a per-app firewall with a Tracker Shield that blocks known trackers for you and a privacy grade per app. Let us look at each one.

Little Snitch, from Objective Development in Vienna, is one of the longest-established Mac firewalls. The current version is 6.5, released on 8 September 2026.

In alert mode, Little Snitch asks you about each new connection, and you can answer once, until the app quits, or forever. Rules can match a process, a domain, host or IP address, a port or port range, a protocol and a direction, and they can expire after a set time or event. If you would rather not be asked, there is a silent mode. Profiles switch automatically based on the network you join.

The Network Monitor shows a live connection list, a map and a traffic chart that reaches back up to 12 months. Version 6 added DNS encryption (DoH, DoT and DoQ) and blocklists you can add by category, such as tracking, ads or malware, plus your own list URLs; none is switched on by default. Where the app's developer provides one, Little Snitch also shows an Internet Access Policy that explains what a connection is for.

That depth is the reason to pick it. If you want to shape your Mac's network behaviour rule by rule, in our view nothing on the Mac goes further. The flip side is attention: you make the decisions and maintain the rules.

Little Snitch is sold as a perpetual licence directly from obdev.at (single, family and multi licences, with reduced upgrade pricing), not on the Mac App Store. In the free demo, the filter runs for three hours at a time and can be restarted. Little Snitch Mini is a separate Mac App Store app: a free network monitor, with blocking and longer history by subscription.

LuLu is a free, open-source (GPLv3) outgoing firewall by Patrick Wardle, who runs Objective-See, a nonprofit that makes free Mac security tools. The current version is 4.5.1, released on 5 August 2026.

When an app makes an outgoing connection that LuLu has no rule for, it shows an alert, and your answer becomes a rule for the whole app or a single destination (optionally with a port). Passive mode runs silently with your existing rules. Block and allow lists can be loaded from a local file or a remote URL; you choose and maintain those lists yourself. Profiles keep separate rule sets and are switched by hand. The Network Monitor menu item opens Objective-See's Netiquette, a live view of current connections.

The code is on GitHub, so it can be audited, and Objective-See states that LuLu collects and transmits no user information.

What LuLu is not built for: it keeps no historical traffic charts, ships no tracker list of its own and has no per-app data limits. Recognising which domain belongs to a tracker is your job, or the job of a list you load.

In our view, LuLu is the best free choice for people who want to decide each connection themselves.

Radio Silence takes the simplest approach: you put apps on a block list and they lose internet access. No connection prompts, no rules to configure. The current version is 3.4.

It is not blind, though. Radio Silence has a real-time network monitor that shows every connection, including helper apps and background processes, and since version 3.4 it lists inbound and outbound connections separately. So you can see what connects, then block the app with one click.

Radio Silence is a one-time purchase with no subscription, with personal and team licences, and the vendor says updates have been free so far.

The trade-off follows from the design. The vendor describes blocking at the app level, so each app is either online or offline: if you block a music app, it cannot stream; if you allow it, it can also reach its analytics servers. Its site does not describe tracker detection, profiles or data limits.

If you simply want certain apps offline and nothing more, in our view Radio Silence is hard to beat for simplicity.

NetMute is the newest tool in this comparison, and it starts from a different question: not "allow this connection?" but "which of my apps are tracking me, and can I stop that without breaking them?"

At its core is a per-app firewall, run from the menu bar and a main window: block an app completely, or only single destinations. On top sits Tracker Shield, a curated list of 300+ tracker domains blocked without a prompt, in apps and in browsers. That is how an app stays online while its tracking does not: in the GeForce NOW example above, both telemetry endpoints were blocked without a single question.

App X-Ray gives every app a privacy grade based on what it actually contacts, so you see which apps deserve a closer look. Quiet Mode records new connections instead of popping them up, and you decide the backlog in one pass. Every rule shows its hit count, and rules that provably cannot fire are named.

For laptops, On the go applies automatically when you join a hotspot, pauses the apps you chose and keeps an eye on a data budget; when you leave, everything goes back. Per-app data limits, custom profiles and schedules round it off. Safari Shield brings the same tracker list into Safari, where it still works once iCloud Private Relay is on and a network filter can no longer see those requests.

NetMute is free to download, with no time limit: the per-app firewall, live traffic per app, Tracker Shield for the 50 most active tracker domains, 5 custom domain blocks and the current week of history. Pro is one purchase, with no subscription and no account: the full 300+ tracker list, App X-Ray, the Privacy Dashboard, reports over months with CSV export and the automation features. Get it on the Mac App Store or as a direct download.

Honest limits: NetMute is closed source, Mac only and has less mileage than Little Snitch. In browsers that resolve names on their own, such as Brave, name-based blocking needs one extra setting; the built-in "Where NetMute protects" check measures where blocking works.

Which one should you pick? Little Snitch if you want the deepest rule control and enjoy maintaining it. LuLu if free and open source come first. Radio Silence if you just want some apps offline. NetMute if your goal is fewer trackers without answering a prompt for every connection. Download NetMute free and look at what your apps connect to.