2

Question: Which firewall can selectively apply multiple named domain resolving rules per app? E.g. like the One Periodic's Hands Off firewall

Details: I'm looking for an app or combination of apps that can give more control or 'gate-keep' outgoing connection requests and identify the domain being resolved by name (not IP address). Not just tell me that "xyz app trying to connect to 12.34.56.78", where I don't have a clue what the IP address or numerical web address is.

I've been using Hands Off for a while and it does this well. However, currently (as of 2022 May), it seems there is no Hands Off firewall app compatible with MacOS Big Sur.

Shortcomings with current alternative (Lulu): When looking for alternatives to Hands Off, I found Lulu, which seems like one of the better firewalls out there. So far though, it's not been a complete solution/alternative.

Shortcoming 1) With Lulu, you can either permanently or temporarily block by process or remote-endpoint (first and second screen shots below). This is great but is lacking when compared to Hands Off.

For example, I use Thunderbird email client to receive/send emails. I often get emails with tracking pixels from say, LinkedIn or a marketing email. When I open an email with Thunderbird, Hands Off immediately prompts that there's an attempt by Thunderbird to respond to the tracking pixel (which is triggering Thunderbird to make a connection unrelated to imap/smtp etc.). So far, I haven't noticed any prompts like this with Lulu.

In Hands Off's dialog prompt window there are four time/occurrence options to block, "Always, Until Quit, Until Reboot, Once" (third screen shot). This is very useful. One of the benefits is that I can selectively allow pixels when I want the sender to know I've opened their campaign email. There are also four connection-type options comprised of Domain/Subdomain Resolving and Outgoing Connections. Also Hands Off shows the name of the domain not just an IP address or numerical domain — more details on this below.

Shortcoming 2) When Lulu prompts for a decision it mostly or almost always shows a numerical web address...I had to google each web address it showed in order to figure out to whom an app was connecting to. With Hands Off, I can easily add the rule "Allow domain name resolving and outgoing network connections to imap.gmail.com". I wasn't able to add such a rule with Lulu...maybe I'm doing something wrong?

Ideas for solutions/workarounds (perhaps the first is the easiest or most realistic):

  1. Use a completely new firewall app (or a combination of apps e.g. firewall + network monitor) that emulates Hands Off's features. Which app/apps has/have those features?...I'm guessing Little Snitch might have these features but wasn't sure, based on what I've seen on their website.

  2. Big Sur-compatible version of Hands Off?...though this seems unlikely as pointed out by @kenston-choi here: Firewall for outgoing connections

  3. Find/create a fork or some sort of add-on for Lulu to enable adding rules by domain — since Lulu is open-source...and modifying the flexibility of rule application via the prompt screen...someone had suggested something similar here https://github.com/objective-see/LuLu/issues/10

PS. For the Thunderbird email pixel use-case above, I couldn't find a Thunderbird Add-on Extension that can selectively block tracking pixels upon-prompt. I've heard that using webmail instead of a client with a web browser extension could resolve this use-case. This is not an option for me, as I need to monitor/access multiple email accounts, hence use an email client like Thunderbird.

Nb. Please let me know if I can make my question more concise/succinct and or add/remove relevant/irrelevant tags.

enter image description here

enter image description here

enter image description here

enter image description here

Improve this question

1 Answer 1

Reset to default
4

I use Little Snitch

Its screens for controlling outgoing connections from external IPs look like the last two screen shots you have but can have more options. The example on that web page shows simple mode but you can expand it

Luckily as I was writing that I got an alert and expanding all options it is like Alert from Little Snitch

Improve this answer
5
  • 3
    Little Snitch also comes with some useful built-in rules, so you don't have to try identify all the thousands of Apple connections etc. The downside is if it asks you if something can connect to 12ab34cd56ef.cdn.cloudfront.somewhere, how the heck do you decide whether or not to allow it? As a result, my Mail just connects to anywhere it likes. I have neither time nor patience to figure all those out one by one ;)
    – Tetsujin
    May 18, 2022 at 16:54
  • 1
    I have only just come across that with Mail. I used to allow no remote access now I am trying Apple's special setting and you do get a lot - I tend to allow cloudfront but not others
    – mmmmmm
    May 18, 2022 at 16:56
  • 1
    I tend to rely on the spam filters, one in MS Outlook [even though I access Outlook only via Mail or web] & SpamSieve to drop them in the 'brown' folder where no remote connections are allowed unless I manually whitelist. The really dodgy ones just get right click deleted from there, never even clicked to read the text part.
    – Tetsujin
    May 18, 2022 at 17:05
  • The point of Little Snitch here is not to catch Spam that is for your mail server as you say but to stop advertising and other indicators
    – mmmmmm
    May 28, 2022 at 13:55
  • Sure, it's just that anything in the spam folder is already blocked from communication entirely unless it is de-classified manually.
    – Tetsujin
    May 29, 2022 at 9:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .