LuLu

LuLu is Objective-See's free, open-source outbound firewall for macOS. It alerts you when a program attempts a new, unauthorized outgoing network connection and lets you allow or block it using rules. Alerts show the responsible process and destination, with additional signing and process-origin information to help you decide. It complements the built-in macOS inbound firewall; it is not an antivirus scanner, a VPN or a guarantee that every possible network connection will be blocked.

Installation and system approval

LuLu4.5.1 requires macOS10.15 Catalina or later and is universal for Intel x86-64 and Apple Silicon ARM64. Its DMG is7,251,712 bytes before installed storage. Copy LuLu.app into Applications, quit an existing LuLu copy before replacing it, then open the copy in Applications to complete setup.

LuLu uses Apple's Network Extension framework. Setup requires manually approving its System Extension and Network Filter through macOS prompts and settings. Copying the app alone does not complete firewall activation. Follow the developer's version-specific approval guide; it does not require a legacy kernel-extension installation or bypassing system security. The developer recommends current macOS updates and specifically recommends at least15.3 for Sequoia because the initial15.0 release had networking problems.

Default rules and decisions

The recommended initial configuration allows Apple programs and programs already installed on the Mac to keep connecting without alerts. The Apple allowance applies to software signed by Apple itself, not every third-party code-signed app. Already-installed software can therefore be allowed automatically; installing LuLu does not mean every existing application will immediately ask for approval. Review these options during setup and change them in Settings if they do not suit your needs.

For an alert, inspect the process, its origin and destination before choosing Block or Allow. By default, a decision applies to the entire program and future destinations; use the detailed rule options when you need a narrower destination, temporary decision or other scope. Rules can identify signed programs by bundle-signing identity so they continue to apply after moves or updates. The4.5.0 Process+Kids option extends a rule to a process and its child processes. Rule order, wildcard/CIDR and regular-expression matching affect the result.

Manage rules in the Rules window and review automatically created allowances as well as manual decisions. Passive or no-client behavior can create allowances instead of interrupting with an alert; absence of a popup does not establish that traffic was blocked. Blocking a legitimate connection can disrupt synchronization, software updates or other network-dependent features.

Limits and privacy

Code-signing information helps identify a program and integrity of its signed code; it is not a malware verdict or a promise that a signed program is trustworthy. LuLu is not advertised as a tamper-proof security boundary against a privileged attacker. The developer's compatibility testing with other firewalls and security products is limited. No blanket compatibility guarantee is provided for every VPN, network filter or security-tool combination; investigate connection problems using the supported tools' guidance.

LuLu checks Objective-See for updates unless update checking is disabled. The developer states that this check transmits no user or product information. Clicking the optional VirusTotal button opens an online lookup containing the item's file hash; it is not a built-in offline antivirus scan. An allowed connection can still transmit private data, and firewall rules do not replace safe software choices or other security controls.

Cost and license

LuLu is free under GPLv3, with optional donations and sponsorship supporting the Objective-See Foundation. There is no required subscription, activation purchase or account for the firewall. Online services such as VirusTotal have their own terms and network behavior.

Official sources: User guide and permissions, Source and GPLv3 license, Official releases.