At a glance
| Prompts for new connections | Blocklists | Rules by network | Usage history | |
|---|---|---|---|---|
| Drippy | Optional | ✓ | And by plan and daily usage | By app, network and day |
| Little Snitch | By default, or silent mode | ✓ | Profiles | Traffic chart by connection |
| LuLu | By default, or passive mode | Your own list | — | — |
| Radio Silence | — | — | — | — |
| TripMode | New apps blocked on chosen networks | — | ✓ | By app, session to month |
Little Snitch
The most complete. It asks before apps connect, supports rules by server, port and protocol, groups them into profiles, and has a network monitor with a world map, blocklists and encrypted DNS. It also has the most to learn.
LuLu
Free and open source, from Objective-See. It alerts on new outgoing connections and keeps rules, with a passive mode and block lists. The best free choice.
Radio Silence
A list of apps that can't connect, and nothing else. No prompts. Good if you know exactly which apps you want offline.
TripMode
Built for hotspots. On networks you choose, apps are blocked until you allow them, with data limits and usage reports.
Drippy
A network monitor with a firewall built in. It keeps usage by app, day and network, and its rules can depend on the network, your plan's free hours, daily usage or how close you are to the cap. It's quiet by default, with an optional Ask mode and blocklists. See Drippy's firewall.
Questions
Do I need a firewall on my Mac?
For incoming connections, turn on the built-in one. For outgoing ones, only if you want to stop apps phoning home or using a metered connection.
What's the best free firewall for Mac?
LuLu. It's free, open source and covers outgoing connections.
Can I use two firewall apps at once?
They usually work, but it's hard to tell which one blocked a connection. Pick one for blocking.