Little Snitch vs LuLu — which Mac firewall should you use?

Last updated: 2026-07-30 · Facts sourced from each project's own documentation

Choose LuLu if you want to be asked before an app phones home, you are comfortable with per-app and per-endpoint rules, and free and open source matters to you. It covers that job well and costs nothing.

Choose Little Snitch if you need the surrounding depth: encrypted DNS, maintained blocklists, a network monitor with traffic analysis, a command line interface, and finer control over servers, domains, ports and protocols.

For most people asking this question for the first time, LuLu is the sensible starting point — it answers the actual worry (what is this app connecting to?) without spending anything, and if you outgrow it you will know precisely which capability you outgrew it for.

Neither one is the answer if your question is how much data did each app use rather than which connections should be allowed. That is usage accounting, a different category — see below, and full disclosure, it is what we make.

What each one is

Little Snitch, by Objective Development, is an application firewall. Its product page describes showing you when applications attempt to connect and letting you allow or deny the connection, with rules that can limit access to specific servers, domains, ports or protocols. Around that core it documents a Connection Alert, a Silent Mode in which new connections are automatically allowed at first, a Network Monitor with real-time activity, mapping and traffic analysis, DNS encryption over DoH, DoT or DoQ, daily-updated topical blocklists, and a command line utility.

LuLu, by Objective-See, is a free, open-source firewall aimed at a specific threat: an application making an outgoing connection you did not authorise, which is how malware exfiltrates data or reaches a command-and-control server. It supports rules per application, per remote endpoint, and with time limits — permanent, for this session only, or expiring after a set number of hours — and can match remote addresses, ports or domains with regular expressions.

Feature comparison

Capability	Little Snitch	LuLu
Ask before an app connects out	✓	✓
Per-application rules	✓	✓
Per-endpoint / per-domain rules	✓ Servers, domains, ports, protocols	✓ Endpoint, port, domain; regex supported
Temporary / expiring rules	Not stated on the product page	✓ Session-only or expiring after N hours
Outgoing connections	✓	✓
Incoming connections	Product page frames it as outbound app control	— Documented as outgoing only
Encrypted DNS (DoH / DoT / DoQ)	✓	—
Curated blocklists	✓ Daily updates	—
Network monitor with traffic analysis	✓ Real-time, with map	—
Command line control	✓	—
Source available	—	✓ Open source, on GitHub
Cost model	Commercial	Free

Blank cells mean the capability is not documented on the vendor's own page, which is not the same as a confirmed absence. Prices, version numbers and ratings are deliberately omitted — they go stale faster than this page can be maintained.

The limitation LuLu documents about itself

This deserves its own section because it is the single fact most likely to change your decision, and it comes from LuLu's own documentation rather than from a critic.

Hostname-based blocking in LuLu works for applications using Network.framework or NSURLSession. Applications built on other networking stacks — Chrome is the named example — are not covered by hostname rules. The documentation also notes that some traffic bypasses Network Extensions entirely and cannot be filtered at all.

If your goal is "stop this specific browser from reaching this specific domain", that is worth knowing before you install. If your goal is "tell me when something unexpected tries to connect out", the limitation matters much less, because the per-application alerting still fires.

When the other one is clearly better

Little Snitch is clearly better when you want to see and understand traffic rather than only permit it — the documented network monitor with traffic analysis has no counterpart in LuLu. It is also the answer if encrypted DNS or maintained blocklists are part of what you are shopping for, or if you want to script rule changes from the command line.

LuLu is clearly better when the budget is zero, when you want to read the source of the thing filtering your traffic, or when you specifically want expiring rules — allow this for one session, or for the next two hours, then go back to asking. That last one is a genuinely useful pattern that the Little Snitch product page does not describe.

If your real question is "how much", not "whether"

Worth naming, because a lot of people arrive at this comparison having asked the wrong question first. Both of these tools answer which connections should be allowed. Neither is built primarily to answer how many gigabytes did each app use this month.

Those are different problems. If you are trying to work out what blew through a data cap, which app uploaded several gigabytes overnight, or whether your hotspot allowance will survive the week, a connection-permission tool will not tell you — it will tell you what is allowed to connect, not what it moved. Usage accounting is a separate category, and Bytetally is what we build for it. If your question really is about rules rather than volume, stay with one of the two above; they are better at it than we are, and we are not trying to be.

Common questions

Is LuLu a full replacement for Little Snitch?

For the core job of being asked before an app connects out, and deciding per app or per endpoint, yes. It is narrower in scope: LuLu's own documentation states it monitors outgoing traffic only, and that hostname-based rules apply to apps using Network.framework or NSURLSession, which excludes browsers such as Chrome that use other networking stacks. Little Snitch additionally documents DNS encryption, curated blocklists, a network monitor with traffic analysis and a command line tool.

Does either of them block incoming connections?

LuLu explicitly does not — its documentation states rules apply to outgoing connections only. Little Snitch's product page describes it as an application firewall that limits which servers, domains, ports and protocols apps may reach, which is also outbound framing. If inbound filtering is your requirement, verify it against current documentation rather than assuming either covers it.

Will either one tell me how much data an app used?

Little Snitch documents a Network Monitor with real-time activity and traffic analysis. LuLu is a connection-permission tool and does not present itself as a usage meter. If your actual question is how many gigabytes each app consumed this month rather than which connections to allow, neither is built primarily for that.

Can I run both at the same time?

Both install a system network extension to filter traffic, and running two filtering extensions together invites unpredictable interactions and duplicate prompts. Pick one. If you want to try the other, remove the first properly first.

If your question turned out to be about volume

Per-app upload and download with caps, throttling and history. All on-device.

Download Free on the Mac App Store

macOS 14 Sonoma or later · 100% on-device · No account