Free Alternative to Little Snitch

LuLu is the most believable free replacement for Little Snitch. Patrick Wardle at Objective-See builds it, and it uses Apple's Network Extension framework to catch every outgoing connection. When a new app tries to reach the internet, LuLu asks you to allow or block it. Version 4.5.1 is native on Apple Silicon and covers macOS 10.15 through Tahoe. You get per-app rules, code signing checks to flag suspicious binaries, a VirusTotal lookup for quick scans, and profiles so a laptop can use different rules at home and on public Wi-Fi. I put LuLu on an M2 Air to compare. It is light. Little Snitch uses noticeably more CPU when its monitor and history are running, while LuLu stays out of the way. Alerts are reliable, they show up when something new connects. What you do not get is Little Snitch's live map, the rolling history, or quiet learning that trusts known Apple system connections over time. Managing rules takes more clicks, and there is no automatic mode that fades into the background. Still, for the core job of stopping unwanted outgoing connections, LuLu works and you can trust who makes it.

Murus is a different kind of tool. It does not watch per-app outgoing connections like Little Snitch. It gives you a readable front end for the PF firewall already inside macOS, the same technology that sits behind pfctl. Murus Lite, the free version, lets you build inbound rules, port forwarding, NAT and logging without touching the command line. If you want outbound per-app alerts from this family, you add Vallum, sold separately. On its own Murus still makes a Mac meaningfully harder to probe from the outside. I tried Murus on Sonoma. The wizard turns a confusing pf ruleset into something you can click through, the log viewer shows blocked attempts right away, and presets cover common patterns like stealth mode. Where it helps most is a Mac acting as a small server or a shared machine on a local network. Murus does not tell you when Safari contacts an analytics domain or when Spotify checks in. You do not get a prompt like Little Snitch gives. For that you need a separate outbound tool. Think of Murus as making the Mac's own firewall usable, not as a direct Little Snitch swap for app-level blocking.

Radio Silence takes the opposite approach to Little Snitch. No constant popups. No per-connection puzzle. You pick apps to block and they lose internet entirely, while everything else keeps working. At $9 it is much cheaper than Little Snitch at $59 and it suits people who find endless firewall prompts tiring. I ran it alongside a normal development week. After blocking a few analytics-heavy utilities and an old sync helper, I forgot it was installed. It uses almost no CPU and you do not need to learn firewall language to use it. The trade is visibility. Once an app is allowed, you have no idea what domains it talks to. If an allowed browser starts hitting a strange host, Radio Silence says nothing. There is no history, no map, no per-domain control and no log to scroll later. It is a blunt switch, not a scalpel. For the narrow job of keeping a known list of apps offline, it does exactly that for a small one-time cost. If you need detail, pair a different tool for viewing.

Netiquette is also from Objective-See, and it is not a firewall. It shows you live network connections on your Mac, which app owns them, the remote addresses and ports, and the state of each session. That visibility is the part of Little Snitch many people value most. It is at its best paired with LuLu. LuLu does the blocking, Netiquette does the watching. I keep Netiquette open when something feels off, like an app unexpectedly reaching out, or when checking a new install. The table is simple: process, PID, local and remote addresses, ports, connection state. You can filter by process or address to narrow things down quickly. You cannot block from Netiquette itself. For that you need LuLu or another firewall. There is no world map and no history log like Little Snitch keeps. As a free, focused way to see what your Mac is doing on the network right now, it is useful and it sits well next to any firewall setup.