AppPermitChoosing a Mac firewall: Little Snitch vs LuLu vs AppPermit
Because the built-in macOS firewall ignores outbound traffic, “which Mac firewall is good” really means “which outbound firewall”. The three common choices are Little Snitch, LuLu and AppPermit, and they take different approaches.
What each one is
- Little Snitch: the long-established commercial option with a mature rule system, inbound and outbound control and a traffic monitor; priced at the higher end. See its website for current features and pricing.
- LuLu: a free, open-source firewall by Objective-See. Its core is “prompt on new outbound connection” — simple and direct; it does not cover files or programs.
- AppPermit: manages network access, file access and launched programs in one per-app permission model, with optional AI explanations; 7-day trial, then a one-time annual pass or lifetime license.
Side by side
| Little Snitch | LuLu | AppPermit | |
|---|---|---|---|
| Per-app outbound control | Yes | Yes | Yes (Follow Global / Relaxed / Standard Protection / No Network) |
| Domain / IP / range rules | Yes | Basic | Yes, allow-lists and block-lists |
| Ask on new address | Yes | Yes | Yes (globally or per app) |
| File access permissions | No | No | Read & write / read-only / ask / folder rules |
| Programs launched by apps | No | No | Visible, with rules |
| AI explanations | No | No | Optional; you pick the provider and working mode |
| Price | Paid (see website) | Free, open source | 7-day trial · $14.99/yr or $29.99 lifetime |
Which one to pick
- You just want “ask me on new connections” at zero cost: LuLu.
- You need a mature rule system and traffic monitoring and price is not a concern: Little Snitch.
- You want file access and launched programs under control too, with AI to explain unfamiliar connections: AppPermit — try it for 7 days and compare.
Note: all of these rely on system extensions. Running two outbound firewalls at once can interfere; keep one active while testing.
FAQ
Can I run AppPermit alongside Little Snitch?
Not recommended. Both use the Network Content Filter extension; running them together can cause duplicate prompts or conflicting rules.
Is AppPermit open source?
No. AppPermit is commercial software. Rules and activity records stay on your Mac; analysis data is sent to your configured service only when you use AI.
Can I migrate rules from Little Snitch?
AppPermit imports and exports its own JSON rule files but does not read other firewalls’ formats, so key rules need to be recreated manually.
AppPermit · A local firewall and app permission manager for macOS
7-day full trial · $14.99/yr or $29.99 lifetime · macOS 14+
7-day full trial · $14.99/yr or $29.99 lifetime · macOS 14+