1

I have downloaded the trial version of Little Snitch.

After install, when I am prompted with connection requests, I have the option to allow or deny the connection via "Any Connection" or "Only" a specific connection.

enter image description here

If I select "Only Forever", I am assuming that the rule will prevent the application from connecting to another address/port.

But if the application wants to connect to another address/port – will I be prompted to set a new rule for that specific address/port – or will the first rule actually block out all future Little Snitch request prompts?

In regards to the above question, does the behavior differ between Allow and Deny? E.g.:

  1. If I Allow ONLY a certain address AND port – will it disable prompts for all future variants of address and/or port?
  2. If I Deny ONLY a certain address AND port – will it disable prompts for all future variants of address and/or port?

I am assuming that (2) above will just deny that specific combination – but what about restricting allowance as in (1)?

Improve this question
4
  • It's Boolean logic. Your choices are allow or deny [of course]. Your operators are then 'who' & 'what'. You can set 'who', 'what' or 'who AND what' or 'who OR what'. Ref [for the full overkill explanation] en.wikipedia.org/wiki/Boolean_algebra
    – Tetsujin
    Commented Jul 10, 2016 at 16:05
  • @Tetsujin I am still not quite understanding if allowing only XYZ:80 forever will prevent LS from prompting if the application may reach ZYX:443. I have read your answer a few times and trying to figure it out, while reinstalling to clear the LS boot caches... It's not really the boolean logic, it's whether LS will prompt me to update my rules when the app makes a request.
    – P A N
    Commented Jul 10, 2016 at 16:09
  • Since it's boolean logic, if I allow only a specific combination – it seems to suggest to me that no further prompts will be made, if indeed LS is contempt with that setting. But what I really want to do is handle each unique rule request it makes.
    – P A N
    Commented Jul 10, 2016 at 16:12
  • Assuming your LS prefs are set to 'if no rule already set, ask' which is default, then [I can only do this in pseudo-code]... if(my.app && xyz.com && 443) deny; else ask; would deny only if all three conditions are met, otherwise it would ask. I still am of the opinion that you ought to start top-down, not bottom-up. You are making a ruleset that will completely confuse you in future otherwise.
    – Tetsujin
    Commented Jul 10, 2016 at 16:13

1 Answer 1

Reset to default
2

If you click Deny on the picture you posted, then no further notifications will be shown [& the connection will be denied] for gamed trying to connect to (static.gc.apple.com AND port 443), not for (static.gc.apple.com OR port 443).

Any & all other connection attempts will be flagged - e.g. a connection to static.gc.apple.com on port 442 would be flagged, or a connection to notstatic.gc.apple.com on post 443 would be flagged.

The next time gamed was launched, your previous deny would again be flagged for your attention, as you only denied it until Quit.

Note:
If you click on the static.gc.apple.com in the line above, you can broaden the domain you wish to block - though it must be said that blocking Apple devices & services [gamed is an Apple service] from connecting to Apple is not really going to be a good move, long-term.
In general terms, Little Snitch can be used to block any or all connections for any app or service - as either a precision tool or a sledgehammer!
It should be used with care.

Improve this answer
5
  • Thanks! Also, I must ask, what if I ALLOW only static.gc.apple.com AND port 443 – will that block future request prompts for that application and/or address? My aim here is to have granular control, so I do not want an allow only restriction to prevent future prompts.
    – P A N
    Commented Jul 10, 2016 at 15:29
  • imo, it depends on your ultimate aim, especially in terms of Apple connectivity. Assuming you consider that Apple as an entity is a trustable domain (if it isn't, then we're all in trouble ;) then it probably makes more sense to first allow any app free reign over the 17.x.x.x domain, which is entirely Apple. Little Snitch is pretty good at knowing 'who is who' on the b ig domains, too, so you could simply allow 'any' to apple.com, iCloud.com etc & it will sort out the actual networks from that. Apple also own a part of the 2.x.x.x domain. [cont'd...]
    – Tetsujin
    Commented Jul 10, 2016 at 15:35
  • [...cont'd] Once that is done, then as with any firewall, hone down from that, rather than trying to work upwards from each tiny sub-domain/service
    – Tetsujin
    Commented Jul 10, 2016 at 15:36
  • Sorry, I should have been more clear – the screenshot is just something I grabbed from the web, and my question does not relate specifically to Apple services :) My question is more about the nature of the rule logic and the prompts.
    – P A N
    Commented Jul 10, 2016 at 15:36
  • OK, then my above 'top-down' still applies - decide what you want to allow rather than deny first. Individual apps you want to prevent 'phoning home' then set specific rule sets for them. LS is as granular as you could ever want.... for example, allow 'all' to connect to xyz.com then deny foobar.app from connecting to ONLY xyz.com on port 21. One of LS's advantages compared to a corporate firewall is it can figure out the rule priority for you
    – Tetsujin
    Commented Jul 10, 2016 at 15:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .