Mac Outbound Firewall: What macOS Misses

Ask most Mac users whether they have a firewall and they'll say yes - it's right there in System Settings, and they switched it on years ago. That's true, and it's also only half the story. The firewall Apple ships watches the front door. It has almost nothing to say about the back one.

That gap matters more than it sounds. When a piece of software on your Mac "phones home" - a legitimate app checking for updates, a browser extension syncing data, or something you didn't install deliberately quietly sending information out - the built-in firewall doesn't stop it, log it, or even ask. It's simply not that firewall's job. This guide explains the blind spot, and how to close it with LuLu, a free, open-source outbound firewall.

macOS ships with an Application Firewall (the one under System Settings → Network → Firewall). Its job description is one-directional: it decides which incoming connections your Mac accepts. Turn it on and it blocks unsolicited connections from the outside world reaching apps that are listening for them - useful, and worth having enabled.

What it does not do is watch what leaves. Every app on your machine is free to open outbound connections to any server on the internet, and the built-in firewall neither prompts you nor records it. For most traffic that's fine - you want your email client talking to your mail server. The problem is that "anything can talk to anyone, silently" is exactly the condition that lets the traffic you'd actually care about hide in the noise:

Malware and adware exfiltrating data or checking in with a command-and-control server.
Trackers and telemetry baked into otherwise ordinary apps, reporting on you in the background.
An app you trust reaching a server you didn't expect - which you'd never know without something watching.

Inbound filtering was the priority twenty years ago, when the threat was network worms scanning for open ports. Today a large share of the risk walks in through a download or a browser and then dials out. An inbound-only firewall is blind to all of it.

What outbound monitoring actually buys you#

Watching outgoing connections turns a silent process into a visible one. Instead of trusting that everything running on your Mac is behaving, you get to see the moment a program tries to reach the network and decide whether that's reasonable.

Concretely, it gives you three things:

Visibility - a running picture of which apps talk to the internet, and where.
Consent - the chance to allow or deny a connection before it happens, per app.
Early warning - an unexpected prompt from a process you don't recognise is often the first sign something is wrong, well before an antivirus scanner would flag it.

None of this replaces good habits or endpoint protection. It's a different layer - and a layer the operating system leaves conspicuously empty.

LuLu: a free, open-source outbound firewall#

LuLu is a free, open-source macOS firewall built specifically to fill that gap. It's made by the Objective-See Foundation, a non-profit founded by security researcher Patrick Wardle, who is well known for building respected free Mac security tools and for publicly scrutinising Apple's own security decisions. The source code is public, which means the "it's not doing anything shady itself" claim is one anyone can actually check - a meaningful distinction for a tool that, by design, sees all your network activity.

How it works#

A few technical points are worth understanding, because they're the reason LuLu is trustworthy on a modern Mac:

It uses Apple's official Network Extension framework - not kernel patches, not undocumented hacks. Earlier Mac firewalls (including LuLu's own first generation) relied on kernel extensions, which Apple has since deprecated and locked down. LuLu was rebuilt as a system extension on the supported, sandboxed API Apple provides for exactly this purpose. That's the difference between a tool fighting the operating system and one working with it.
It observes connections at the process level. When a program tries to open an outbound connection, LuLu sees which program, running from which path, whether it's properly code-signed, and where it's trying to connect.
Unknown connections are blocked by default until you approve them. The first time an app reaches out, LuLu holds the connection and shows you an alert with those details - process name, disk location, code-signature status, and destination address - and asks whether to allow or deny it. Your answer becomes a rule, so you're only asked once per app.
It coexists with Apple's built-in firewall. LuLu doesn't replace or conflict with the Application Firewall - it complements it. Apple's handles inbound; LuLu handles outbound. Run both.

It's actively maintained and requires macOS 10.15 (Catalina) or later. Installation and updates come straight from Objective-See.

Reading it like a security engineer: what egress control actually catches#

Watching outbound traffic isn't a novelty - it's a core enterprise control called egress filtering, and it maps directly onto how modern attacks unfold. The reason it's worth doing on an endpoint is that almost every stage of an intrusion after the initial foothold has to cross the network on the way out:

Command-and-control (C2) beaconing. Once malware lands, it typically "calls home" to receive instructions, often on a regular interval. That callback is an outbound connection - invisible to an inbound-only firewall, and exactly the kind of unexpected destination an egress control surfaces.
Data exfiltration. Stolen credentials, documents, or keystrokes have to leave the machine to be useful to an attacker. Every exfil path is outbound traffic to somewhere you didn't sanction.
DNS and protocol abuse. Attackers tunnel data over DNS or hide it inside ordinary-looking HTTPS precisely because they assume nobody is watching what leaves. Even without decrypting anything, seeing that an unfamiliar process is resolving and connecting is a signal.
Adware, spyware, and app telemetry. Far more common than targeted malware: legitimate-looking software that quietly reports back. This is the noisy, everyday case where outbound visibility pays for itself immediately.

The security value here is not that a host firewall stops a determined adversary - more on why it doesn't below - but that it converts silent network activity into an event you can see and reason about. In detection terms, you're trading a blind spot for a signal. An unexpected outbound prompt from a process you can't account for is one of the highest-fidelity, earliest indicators a normal user will ever get - it fires at the C2 or exfil stage, often long before a signature-based scanner has anything to match on.

That's the lens to read a tool like LuLu through: it's an egress-visibility and consent control for a single host, giving an individual a scaled-down version of what a well-run network gives an enterprise.

The honest limits: a host firewall an attacker can often walk around#

House rule at bluwarden: name the limits honestly. The failure mode with any host-based outbound firewall is treating it as a barrier when it's really a tripwire. Understanding where it can be bypassed is what tells you how much to lean on it.

A capable attacker can piggyback on traffic you already allowed. The moment you approve your browser or a system updater to reach the internet, that rule is a road. Malware running with your privileges can inject into an approved process, or simply drive an already-trusted app (a browser, a scripting tool, a signed Apple binary) to make the connection on its behalf. The firewall sees a permitted process talking to the network and stays quiet. This is the central limitation: outbound rules are attached to processes, and processes can be borrowed.
It lives at the same privilege level it's trying to police. A host firewall is software on the host. Malware that gains root or kernel-level access is, in principle, positioned to disable, unload, or route around it. A control can't reliably contain a threat that outranks it - which is precisely why network-layer egress filtering exists in serious environments: it sits somewhere the endpoint can't tamper with.
It doesn't detect malware, and it doesn't decrypt. LuLu has no notion of "good" or "bad," and no signature database - it reports that a connection is happening and where, not what it is or what's inside it. That metadata-only design is privacy-respecting and correct for the job, but it means the judgment call is yours.
Alert fatigue is a real attack surface. A control that asks the user to decide is only as strong as the user's attention. Train someone (or yourself) to reflexively click "Allow" to make prompts go away and the whole mechanism inverts into a rubber stamp. The security relies on the prompts staying rare and being read - which they are, after the initial tuning, but it's a genuine dependency, not a footnote.

Put together, that's why an outbound firewall is best understood as a detection-and-consent layer for the opportunistic, noisy majority of threats - adware, sloppy telemetry, commodity malware, the app doing something you didn't expect - rather than a hard stop against a targeted, privileged adversary. That's not a knock; it's the correct scope. The mistake is expecting one tripwire to be a whole perimeter.

Where it fits: one instrument in defence-in-depth#

The engineering answer is that no single control is the answer - you layer them so that what one misses another catches:

Least privilege first. Most of the bypasses above assume malware is already running as you. Not handing untrusted software that foothold - careful about downloads, permissions, and what you actually run - is what makes every later layer more effective.
Endpoint detection (EDR/antivirus) covers the "what is this" question an outbound firewall deliberately doesn't answer, catching known-bad software by behaviour and signature.
Outbound/egress visibility - the layer this post is about - catches the network stage: the beacon, the exfil, the unexpected destination, including from software the scanner didn't flag.
Network-layer egress filtering, in an organisation, puts that same control somewhere the endpoint can't switch off - the tamper-resistant version of what a host firewall does per-machine.

For an individual, a free host firewall like LuLu is a genuinely worthwhile layer - cheap, transparent, and high-signal. For an organisation, it's the endpoint half of a story that should also include network egress rules and proper detection. Either way, the point is that it's one instrument on the dashboard, chosen deliberately because you understand exactly what it does and doesn't cover.

The one caveat worth knowing: Apple's traffic used to get a pass#

Here's a piece of history that's directly relevant, and that a lot of write-ups skip.

When Apple shipped the first beta of macOS 11 Big Sur in 2020, it included a mechanism (an internal exclusion list) that let around fifty of Apple's own apps and services bypass third-party network filters entirely - including tools built on the very Network Extension framework LuLu uses. In plain terms: a chunk of Apple's own traffic could route around outbound firewalls without ever generating a prompt. Patrick Wardle - the person behind LuLu - was among those who publicly called it out, on the reasonable grounds that a firewall you can't fully trust to see everything is a firewall with a hole in it.

The important part: Apple removed that exclusion in macOS 11.2, in early 2021. On any current version of macOS, that bypass no longer exists, and third-party outbound firewalls see Apple's traffic like any other. So this isn't a live limitation - it's a reminder that outbound visibility on a closed platform ultimately depends on the platform vendor's choices, and it's worth knowing the arrangement wasn't always as complete as it is today. If you run into an older guide claiming Apple traffic "can't be filtered," that's the outdated context it's referring to.

Summary#

The highest-impact takeaways:

The macOS built-in firewall is inbound-only. It watches connections coming in, not what your Mac sends out - a genuine blind spot, not a misconfiguration.
Outbound monitoring gives you visibility and consent over which apps reach the internet and where, and it's often the earliest warning that something is wrong.
LuLu fills that gap for free - open-source, built on Apple's official Network Extension framework, working per-process, and coexisting with the built-in firewall rather than replacing it.
Its value depends on you reading the prompts. Blindly allowing everything protects you from nothing; the tool surfaces the decision, it can't make it.
It's one layer, not the whole defence. Pair it with endpoint protection, careful downloads, and the rest of your device hygiene - it doesn't detect malware or decrypt traffic, and doesn't claim to.

An outbound firewall is one of the cheapest, highest-signal upgrades you can make to a Mac - much like choosing a more private browser or getting your passwords and MFA in order, it closes a gap most people don't know they have. And as with those, the biggest wins on any device come from a handful of deliberate choices rather than one magic install - the same theme runs through what actually breaks company security.

Want outbound monitoring and endpoint protection set up consistently across your Macs? Get in touch - bluwarden can build a macOS security baseline matched to your risk.

This guide is general advice, not a substitute for a risk assessment tailored to your situation. macOS features and defaults change between releases - re-check settings after major updates. For a setup matched to a specific threat model, consult a qualified security professional.