{
  "@context": [
    "https://schema.org",
    {
      "nuanyue": "https://www.nuanyue.com/ns#"
    }
  ],
  "@type": "SoftwareApplication",
  "@id": "https://www.nuanyue.com/software/lulu/#software",
  "name": "LuLu",
  "description": "Free, open-source macOS firewall that alerts you to every new outgoing connection, with scoped and time-limited rules, allow and block lists, profiles and a bundled network monitor.",
  "url": "https://www.nuanyue.com/software/lulu/",
  "mainEntityOfPage": "https://www.nuanyue.com/software/lulu/",
  "operatingSystem": "macOS",
  "applicationCategory": "SecurityApplication",
  "publisher": {
    "name": "Objective-See",
    "url": "https://objective-see.org/"
  },
  "sameAs": [
    "https://objective-see.com/products/lulu.html",
    "https://github.com/objective-see/LuLu"
  ],
  "softwareVersion": "4.5.1",
  "license": "GPL-3.0",
  "offers": {
    "@type": "Offer",
    "price": "0",
    "priceCurrency": "USD"
  },
  "nuanyue:record": {
    "schemaVersion": 1,
    "id": "software:lulu",
    "slug": "lulu",
    "name": "LuLu",
    "type": "SoftwareApplication",
    "entityType": "firewall",
    "description": "Free, open-source macOS firewall that alerts you to every new outgoing connection, with scoped and time-limited rules, allow and block lists, profiles and a bundled network monitor.",
    "shortDescription": "Free open-source firewall for blocking outgoing connections on macOS.",
    "answer": "LuLu is an outgoing firewall for macOS: it watches for new connections leaving your Mac and asks you what to do about them. That is the gap it was built to fill, because Apple's built-in firewall only handles incoming connections. Every alert shows the process and the destination, with block and allow buttons, and expands to include the code-signing information, the process hierarchy and a VirusTotal lookup. Rules can be scoped to a whole process or to a single remote endpoint, and given a lifetime — always, until the process exits, or until a set time. Allow and block lists can override the rules entirely. It is free, open source, macOS 10.15 or later, and it bundles a network monitor.",
    "page": "https://www.nuanyue.com/software/lulu/",
    "dataUrl": "https://www.nuanyue.com/data/software/lulu.json",
    "categories": [
      "security"
    ],
    "tags": [],
    "platform": [
      "macOS"
    ],
    "minOsVersion": "macOS 10.15",
    "architecture": [],
    "featured": false,
    "pricing": "open-source",
    "pricingDescription": "Free, with no paid tier and no account. The source is published under the GPL-3.0 and the vendor distributes a signed disk image directly, alongside a published SHA-256 hash for it. Donations support the work.",
    "license": "GPL-3.0",
    "currentVersion": "4.5.1",
    "openSource": true,
    "website": "https://objective-see.com/products/lulu.html",
    "github": "https://github.com/objective-see/LuLu",
    "download": "https://github.com/objective-see/LuLu/releases/download/v4.5.1/LuLu_4.5.1.dmg",
    "developer": {
      "name": "Objective-See",
      "website": "https://objective-see.org/"
    },
    "features": [
      "Alerts whenever a new or unauthorized outgoing connection is created",
      "Alerts show the process name and destination, with block and allow actions",
      "Alert details include code-signing information, the process hierarchy and a VirusTotal lookup",
      "Rules grouped as All, Default, Apple, 3rd-party program, User and Recent",
      "Rule scope: the entire process, or only the remote endpoint",
      "Rule duration: always, for the lifetime of the process, or expiring at a set time",
      "Rules can be added, edited, deleted, imported and exported, with regex support for addresses and domains and * for any",
      "Allow and Block lists that supersede rules, loaded from a local file or a remote URL",
      "Profiles that bundle a set of rules and settings and can be switched at once",
      "Passive mode, which runs silently and applies existing rules without prompting",
      "Block mode, which blocks all routed traffic",
      "Options to hide the menu bar icon and to disable VirusTotal lookups",
      "Bundles Netiquette, Objective-See's network monitor",
      "Starts automatically at login once configured"
    ],
    "useCases": [
      "Finding out when an application you installed starts phoning home",
      "Stopping one process from reaching the network while leaving everything else alone",
      "Switching between a permissive profile at home and a strict one elsewhere",
      "Checking whether a process that just connected out is signed, and what it is"
    ],
    "formats": [],
    "integrations": [],
    "pros": [
      {
        "text": "Alerts on every new or unauthorized outgoing connection, showing the process and the destination with block and allow actions.",
        "status": "developer-stated",
        "source": "official",
        "verifiedAt": "2026-10-05T00:00:00.000Z"
      },
      {
        "text": "Alert details include code-signing information, the process hierarchy and a VirusTotal lookup button.",
        "status": "developer-stated",
        "source": "official",
        "verifiedAt": "2026-10-05T00:00:00.000Z"
      },
      {
        "text": "Rules can be scoped to an entire process or to just the remote endpoint, and given a duration of always, the process lifetime, or a set expiry.",
        "status": "developer-stated",
        "source": "official",
        "verifiedAt": "2026-10-05T00:00:00.000Z"
      },
      {
        "text": "Allow and Block lists supersede individual rules and can be loaded from a local file or a remote URL.",
        "status": "developer-stated",
        "source": "official",
        "verifiedAt": "2026-10-05T00:00:00.000Z"
      },
      {
        "text": "Profiles bundle a set of rules and settings that can be switched in one step.",
        "status": "developer-stated",
        "source": "official",
        "verifiedAt": "2026-10-05T00:00:00.000Z"
      },
      {
        "text": "A Passive mode runs silently and applies existing rules without prompting, and a Block mode blocks all routed traffic.",
        "status": "developer-stated",
        "source": "official",
        "verifiedAt": "2026-10-05T00:00:00.000Z"
      },
      {
        "text": "Free and open source under the GPL-3.0, with a signed disk image distributed directly and a published SHA-256 hash.",
        "status": "verified",
        "source": "repository",
        "verifiedAt": "2026-10-05T00:00:00.000Z"
      },
      {
        "text": "Requires macOS 10.15 or later, and starts automatically at login once configured.",
        "status": "verified",
        "source": "official",
        "verifiedAt": "2026-10-05T00:00:00.000Z"
      },
      {
        "text": "Bundles Netiquette, Objective-See's network monitor, so you can watch traffic as well as control it.",
        "status": "developer-stated",
        "source": "official",
        "verifiedAt": "2026-10-05T00:00:00.000Z"
      }
    ],
    "cons": [
      {
        "text": "macOS only — there is no build for other platforms.",
        "status": "verified",
        "source": "official",
        "verifiedAt": "2026-10-05T00:00:00.000Z"
      },
      {
        "text": "It covers outgoing connections only; Apple's built-in firewall is what blocks incoming ones.",
        "status": "developer-stated",
        "source": "official",
        "verifiedAt": "2026-10-05T00:00:00.000Z"
      },
      {
        "text": "Until rules have accumulated, answering a prompt for each new connection is intrusive.",
        "status": "derived",
        "source": "official",
        "verifiedAt": "2026-10-05T00:00:00.000Z"
      },
      {
        "text": "By default it contacts Objective-See.org at startup to check for updates, though the vendor states no user or product information is collected or transmitted and the check can be turned off.",
        "status": "verified",
        "source": "official",
        "verifiedAt": "2026-10-05T00:00:00.000Z"
      },
      {
        "text": "Only rules the user created can be exported; the built-in rule sets cannot.",
        "status": "developer-stated",
        "source": "official",
        "verifiedAt": "2026-10-05T00:00:00.000Z"
      }
    ],
    "whoIsItFor": [
      "Mac users who want an outgoing firewall without paying for one",
      "Anyone who wants to know which processes on their Mac are making network connections"
    ],
    "notFor": [
      "Anyone who needs long-term traffic history and per-connection reporting, which a network monitor provides and a firewall does not",
      "People who do not want to answer connection prompts at all"
    ],
    "limitations": [
      "macOS only; there is no Windows or Linux version",
      "It covers outgoing connections only. Apple's built-in firewall is what handles incoming ones, so the two are complements rather than alternatives",
      "Answering a prompt for each new connection is intrusive until rules have accumulated",
      "Only rules you created yourself can be exported",
      "Whether the current release is a universal binary is not stated in the sources Nuanyue tracks; Objective-See publishes a single disk image for macOS 10.15 and later",
      "By default it contacts Objective-See.org on startup to check for a new version; the vendor states that no user or product information is collected or transmitted, and the check can be disabled"
    ],
    "firstUse": {
      "installation": {
        "value": "Downloaded as a disk image from the project's GitHub releases, or from the vendor's product page, which also publishes a SHA-256 hash for the image.",
        "status": "verified",
        "source": "official",
        "verifiedAt": "2026-10-05T00:00:00.000Z"
      },
      "firstLaunch": {
        "value": "LuLu asks for the permissions it needs to filter connections, then begins raising alerts as applications attempt to connect out. Once configured it starts automatically each time you log in.",
        "status": "developer-stated",
        "source": "official",
        "verifiedAt": "2026-10-05T00:00:00.000Z"
      },
      "systemIntegration": {
        "value": "Runs as a background firewall filtering outgoing traffic from every process, with a menu bar item for status and settings.",
        "status": "developer-stated",
        "source": "official",
        "verifiedAt": "2026-10-05T00:00:00.000Z"
      },
      "appleSilicon": {
        "value": null,
        "status": "unknown"
      }
    },
    "updates": [],
    "faq": [
      {
        "question": "Is LuLu free?",
        "answer": "Yes. The vendor describes it as a free, open-source firewall, and the source is published under the GPL-3.0. There is no paid tier and no account; the disk image is distributed directly with a published SHA-256 hash, and donations fund the work.",
        "status": "verified",
        "source": "official",
        "verifiedAt": "2026-10-05T00:00:00.000Z"
      },
      {
        "question": "How is LuLu different from the firewall built into macOS?",
        "answer": "Apple's built-in firewall only blocks incoming connections. LuLu is designed to detect and block unauthorized outgoing connections — for example when malware tries to reach its command and control server or to exfiltrate data — so it addresses a different direction of traffic rather than replacing the system firewall.",
        "status": "developer-stated",
        "source": "official",
        "verifiedAt": "2026-10-05T00:00:00.000Z"
      },
      {
        "question": "Which macOS versions does LuLu support?",
        "answer": "The current release, v4.5.1, is published for macOS 10.15 and later. The vendor also lists a SHA-256 hash for the disk image so the download can be verified.",
        "status": "verified",
        "source": "official",
        "verifiedAt": "2026-10-05T00:00:00.000Z"
      },
      {
        "question": "Can LuLu show me what my network traffic looks like?",
        "answer": "Partly. LuLu is a firewall rather than a monitor, but it bundles Netiquette — an Objective-See network monitor packaged into LuLu — which you can launch from the application to see traffic.",
        "status": "developer-stated",
        "source": "official",
        "verifiedAt": "2026-10-05T00:00:00.000Z"
      },
      {
        "question": "Does LuLu send any data about me?",
        "answer": "The vendor states that when LuLu starts it connects to Objective-See.org to check whether a new version exists, and that no user or product information is collected or transmitted. The check can be turned off with the 'Disable Update Checks' option.",
        "status": "verified",
        "source": "official",
        "verifiedAt": "2026-10-05T00:00:00.000Z"
      }
    ],
    "relationships": [
      {
        "target": "little-snitch",
        "type": "alternative",
        "reason": "Both are outgoing firewalls for macOS that ask before an app connects, but LuLu is free and open source while Little Snitch is a paid, closed-source product with rule groups, long-term traffic history and built-in DNS encryption.",
        "verifiedAt": "2026-10-05T00:00:00.000Z"
      },
      {
        "target": "puresnitch",
        "type": "similar",
        "reason": "Both are open-source outgoing firewalls for macOS, but LuLu comes from Objective-See with VirusTotal lookups and profiles, while PureSnitch builds its interface around a Little Snitch-style world map and pf-based blocking.",
        "verifiedAt": "2026-10-05T00:00:00.000Z"
      },
      {
        "target": "blockblock",
        "type": "complements",
        "reason": "Both are Objective-See security tools that watch different things: BlockBlock alerts you when software installs itself to persist, and LuLu then decides what that software is allowed to do on the network.",
        "verifiedAt": "2026-10-05T00:00:00.000Z"
      }
    ],
    "sources": [
      {
        "id": "lulu:official",
        "type": "official_website",
        "url": "https://objective-see.com/products/lulu.html",
        "title": "LuLu — official website",
        "trustLevel": "B",
        "accessedAt": null
      },
      {
        "id": "lulu:developer",
        "type": "developer",
        "url": "https://objective-see.org/",
        "title": "Objective-See — developer website",
        "trustLevel": "B",
        "accessedAt": null
      },
      {
        "id": "lulu:repository",
        "type": "github",
        "url": "https://github.com/objective-see/LuLu",
        "title": "LuLu — source repository",
        "trustLevel": "D",
        "accessedAt": null
      }
    ],
    "claims": [
      {
        "id": "software:lulu.isA",
        "subject": "software:lulu",
        "predicate": "isA",
        "value": "firewall",
        "status": "editorially-reviewed",
        "sourceIds": [
          "lulu:official"
        ],
        "lastVerified": null
      },
      {
        "id": "software:lulu.supportsPlatform",
        "subject": "software:lulu",
        "predicate": "supportsPlatform",
        "value": [
          "macOS"
        ],
        "status": "verified",
        "sourceIds": [
          "lulu:official"
        ],
        "lastVerified": null
      },
      {
        "id": "software:lulu.officialWebsite",
        "subject": "software:lulu",
        "predicate": "officialWebsite",
        "value": "https://objective-see.com/products/lulu.html",
        "status": "verified",
        "sourceIds": [
          "lulu:official"
        ],
        "lastVerified": null
      },
      {
        "id": "software:lulu.listedInCategory",
        "subject": "software:lulu",
        "predicate": "listedInCategory",
        "value": [
          "security"
        ],
        "status": "editorially-reviewed",
        "sourceIds": [
          "lulu:official"
        ],
        "lastVerified": null
      },
      {
        "id": "software:lulu.pricingModel",
        "subject": "software:lulu",
        "predicate": "pricingModel",
        "value": "Open source",
        "status": "developer-stated",
        "sourceIds": [
          "lulu:official"
        ],
        "lastVerified": null
      },
      {
        "id": "software:lulu.developedBy",
        "subject": "software:lulu",
        "predicate": "developedBy",
        "value": "Objective-See",
        "status": "developer-stated",
        "sourceIds": [
          "lulu:developer",
          "lulu:official"
        ],
        "lastVerified": null
      },
      {
        "id": "software:lulu.ownership",
        "subject": "software:lulu",
        "predicate": "ownership",
        "value": "Third-party product — not published by Nuanyue",
        "status": "editorially-reviewed",
        "sourceIds": [],
        "lastVerified": null
      },
      {
        "id": "software:lulu.isOpenSource",
        "subject": "software:lulu",
        "predicate": "isOpenSource",
        "value": true,
        "status": "verified",
        "sourceIds": [
          "lulu:repository",
          "lulu:official"
        ],
        "lastVerified": null
      },
      {
        "id": "software:lulu.licensedUnder",
        "subject": "software:lulu",
        "predicate": "licensedUnder",
        "value": "GPL-3.0",
        "status": "verified",
        "sourceIds": [
          "lulu:repository",
          "lulu:official"
        ],
        "lastVerified": null
      },
      {
        "id": "software:lulu.currentVersion",
        "subject": "software:lulu",
        "predicate": "currentVersion",
        "value": "4.5.1",
        "status": "developer-stated",
        "sourceIds": [
          "lulu:official"
        ],
        "lastVerified": null
      },
      {
        "id": "software:lulu.hasFeature",
        "subject": "software:lulu",
        "predicate": "hasFeature",
        "value": [
          "Alerts whenever a new or unauthorized outgoing connection is created",
          "Alerts show the process name and destination, with block and allow actions",
          "Alert details include code-signing information, the process hierarchy and a VirusTotal lookup",
          "Rules grouped as All, Default, Apple, 3rd-party program, User and Recent",
          "Rule scope: the entire process, or only the remote endpoint",
          "Rule duration: always, for the lifetime of the process, or expiring at a set time",
          "Rules can be added, edited, deleted, imported and exported, with regex support for addresses and domains and * for any",
          "Allow and Block lists that supersede rules, loaded from a local file or a remote URL",
          "Profiles that bundle a set of rules and settings and can be switched at once",
          "Passive mode, which runs silently and applies existing rules without prompting",
          "Block mode, which blocks all routed traffic",
          "Options to hide the menu bar icon and to disable VirusTotal lookups",
          "Bundles Netiquette, Objective-See's network monitor",
          "Starts automatically at login once configured"
        ],
        "status": "editorially-reviewed",
        "sourceIds": [
          "lulu:official"
        ],
        "lastVerified": null
      },
      {
        "id": "software:lulu.usedFor",
        "subject": "software:lulu",
        "predicate": "usedFor",
        "value": [
          "Finding out when an application you installed starts phoning home",
          "Stopping one process from reaching the network while leaving everything else alone",
          "Switching between a permissive profile at home and a strict one elsewhere",
          "Checking whether a process that just connected out is signed, and what it is"
        ],
        "status": "editorially-reviewed",
        "sourceIds": [
          "lulu:official"
        ],
        "lastVerified": null
      },
      {
        "id": "software:lulu.audienceFor",
        "subject": "software:lulu",
        "predicate": "audienceFor",
        "value": [
          "Mac users who want an outgoing firewall without paying for one",
          "Anyone who wants to know which processes on their Mac are making network connections"
        ],
        "status": "editorially-reviewed",
        "sourceIds": [
          "lulu:official"
        ],
        "lastVerified": null
      },
      {
        "id": "software:lulu.audienceNotFor",
        "subject": "software:lulu",
        "predicate": "audienceNotFor",
        "value": [
          "Anyone who needs long-term traffic history and per-connection reporting, which a network monitor provides and a firewall does not",
          "People who do not want to answer connection prompts at all"
        ],
        "status": "editorially-reviewed",
        "sourceIds": [
          "lulu:official"
        ],
        "lastVerified": null
      },
      {
        "id": "software:lulu.limitation",
        "subject": "software:lulu",
        "predicate": "limitation",
        "value": [
          "macOS only; there is no Windows or Linux version",
          "It covers outgoing connections only. Apple's built-in firewall is what handles incoming ones, so the two are complements rather than alternatives",
          "Answering a prompt for each new connection is intrusive until rules have accumulated",
          "Only rules you created yourself can be exported",
          "Whether the current release is a universal binary is not stated in the sources Nuanyue tracks; Objective-See publishes a single disk image for macOS 10.15 and later",
          "By default it contacts Objective-See.org on startup to check for a new version; the vendor states that no user or product information is collected or transmitted, and the check can be disabled"
        ],
        "status": "editorially-reviewed",
        "sourceIds": [],
        "lastVerified": null
      },
      {
        "id": "software:lulu.advantage.0",
        "subject": "software:lulu",
        "predicate": "advantage",
        "value": "Alerts on every new or unauthorized outgoing connection, showing the process and the destination with block and allow actions.",
        "status": "developer-stated",
        "sourceIds": [
          "lulu:official"
        ],
        "lastVerified": "2026-10-05"
      },
      {
        "id": "software:lulu.advantage.1",
        "subject": "software:lulu",
        "predicate": "advantage",
        "value": "Alert details include code-signing information, the process hierarchy and a VirusTotal lookup button.",
        "status": "developer-stated",
        "sourceIds": [
          "lulu:official"
        ],
        "lastVerified": "2026-10-05"
      },
      {
        "id": "software:lulu.advantage.2",
        "subject": "software:lulu",
        "predicate": "advantage",
        "value": "Rules can be scoped to an entire process or to just the remote endpoint, and given a duration of always, the process lifetime, or a set expiry.",
        "status": "developer-stated",
        "sourceIds": [
          "lulu:official"
        ],
        "lastVerified": "2026-10-05"
      },
      {
        "id": "software:lulu.advantage.3",
        "subject": "software:lulu",
        "predicate": "advantage",
        "value": "Allow and Block lists supersede individual rules and can be loaded from a local file or a remote URL.",
        "status": "developer-stated",
        "sourceIds": [
          "lulu:official"
        ],
        "lastVerified": "2026-10-05"
      },
      {
        "id": "software:lulu.advantage.4",
        "subject": "software:lulu",
        "predicate": "advantage",
        "value": "Profiles bundle a set of rules and settings that can be switched in one step.",
        "status": "developer-stated",
        "sourceIds": [
          "lulu:official"
        ],
        "lastVerified": "2026-10-05"
      },
      {
        "id": "software:lulu.advantage.5",
        "subject": "software:lulu",
        "predicate": "advantage",
        "value": "A Passive mode runs silently and applies existing rules without prompting, and a Block mode blocks all routed traffic.",
        "status": "developer-stated",
        "sourceIds": [
          "lulu:official"
        ],
        "lastVerified": "2026-10-05"
      },
      {
        "id": "software:lulu.advantage.6",
        "subject": "software:lulu",
        "predicate": "advantage",
        "value": "Free and open source under the GPL-3.0, with a signed disk image distributed directly and a published SHA-256 hash.",
        "status": "verified",
        "sourceIds": [
          "lulu:repository"
        ],
        "lastVerified": "2026-10-05"
      },
      {
        "id": "software:lulu.advantage.7",
        "subject": "software:lulu",
        "predicate": "advantage",
        "value": "Requires macOS 10.15 or later, and starts automatically at login once configured.",
        "status": "verified",
        "sourceIds": [
          "lulu:official"
        ],
        "lastVerified": "2026-10-05"
      },
      {
        "id": "software:lulu.advantage.8",
        "subject": "software:lulu",
        "predicate": "advantage",
        "value": "Bundles Netiquette, Objective-See's network monitor, so you can watch traffic as well as control it.",
        "status": "developer-stated",
        "sourceIds": [
          "lulu:official"
        ],
        "lastVerified": "2026-10-05"
      },
      {
        "id": "software:lulu.drawback.0",
        "subject": "software:lulu",
        "predicate": "drawback",
        "value": "macOS only — there is no build for other platforms.",
        "status": "verified",
        "sourceIds": [
          "lulu:official"
        ],
        "lastVerified": "2026-10-05"
      },
      {
        "id": "software:lulu.drawback.1",
        "subject": "software:lulu",
        "predicate": "drawback",
        "value": "It covers outgoing connections only; Apple's built-in firewall is what blocks incoming ones.",
        "status": "developer-stated",
        "sourceIds": [
          "lulu:official"
        ],
        "lastVerified": "2026-10-05"
      },
      {
        "id": "software:lulu.drawback.2",
        "subject": "software:lulu",
        "predicate": "drawback",
        "value": "Until rules have accumulated, answering a prompt for each new connection is intrusive.",
        "status": "derived",
        "sourceIds": [
          "lulu:official"
        ],
        "lastVerified": "2026-10-05"
      },
      {
        "id": "software:lulu.drawback.3",
        "subject": "software:lulu",
        "predicate": "drawback",
        "value": "By default it contacts Objective-See.org at startup to check for updates, though the vendor states no user or product information is collected or transmitted and the check can be turned off.",
        "status": "verified",
        "sourceIds": [
          "lulu:official"
        ],
        "lastVerified": "2026-10-05"
      },
      {
        "id": "software:lulu.drawback.4",
        "subject": "software:lulu",
        "predicate": "drawback",
        "value": "Only rules the user created can be exported; the built-in rule sets cannot.",
        "status": "developer-stated",
        "sourceIds": [
          "lulu:official"
        ],
        "lastVerified": "2026-10-05"
      }
    ],
    "lastUpdated": "2026-10-05T00:00:00.000Z",
    "lastReviewedAt": null
  }
}