Open-source application firewall for macOS. Built in the same style as Little Snitch. Free. MIT-licensed. Zero telemetry.
Why this exists
Gold standard UI. World map, rules, alerts. Commercial software.
Excellent per-process kernel filtering. Spartan UI. No map, no graph, no blocklists.
Blocks inbound only. Outbound traffic walks right out the front door.
Little Snitch UI muscle memory. LuLu's price. Native SwiftUI, not a port. Developer ID-signed and Apple-notarized. Source on GitHub, MIT, zero telemetry. Built because no one else had built it.
Features
Live connections and process-level bandwidth with sorting and filtering. The map UI is present, but v0.2.1 does not perform live IP geolocation or per-connection byte accounting.
Browse, search, toggle and delete stored rules across All Rules, Active, Deny, Temporary and Unapproved categories. In v0.2.1, new persistent rules come only from DNS-proxy alerts; general add/import/export controls are not implemented.
Allow / Deny prompts for ask decisions from the manually configured DNS proxy. Passive app sockets are not paused; arbitrary per-process prompts require the non-shipping Network Extension build.
Experimental loopback proxy with DoH to Cloudflare, Quad9, Google, or a custom HTTPS endpoint. Clients must be configured manually; system DNS is unchanged.
1Hosts, OISD, StevenBlack and HaGeZi are included. Enabled built-in lists refresh at helper startup and on request. v0.2.1 cannot add custom blocklist URLs.
A runtime com.apple/puresnitch anchor carries validated, host-wide deny rules for IPv4 / CIDR / port targets. PureSnitch does not rewrite the active main ruleset.
Only Default is enforced in the shipping build. Home, Public Wi-Fi and Lockdown are stored labels; SSID-based switching is not implemented.
Live up/down throughput. 5-minute traffic graph. Recent activity. Denied-count badge. One-click mode picker.
No analytics SDK, crash reporter, or license check. No live IP-geolocation requests. Network access is limited to enabled blocklist refreshes and explicitly proxied DNS.
How it works
PureSnitch is a SwiftUI app talking over XPC to a small privileged daemon. The daemon does the actual work.
An experimental loopback proxy answers requests from manually configured clients. Blocklisted domains return NXDOMAIN; the rest forwards over DoH. PureSnitch does not install it as the macOS resolver.
A runtime com.apple/puresnitch sub-anchor carries Default-profile, host-wide deny rules for IPv4, CIDR and port targets. It does not add declarations to /etc/pf.conf.
nettop streams per-process bandwidth, lsof snapshots active connections every 2s. Both feed the GUI's process list, map and graphs.
┌─────────────────────────────────────────────────────────┐
│ PureSnitch.app │
│ ┌───────────────────────────────────────────────────┐ │
│ │ SwiftUI GUI │ │
│ │ · Menubar status item · Network Monitor window │ │
│ │ · Rules Manager · Connection Alert popups │ │
│ └────────────────────────┬──────────────────────────┘ │
│ │ XPC (Mach service) │
│ ┌────────────────────────▼──────────────────────────┐ │
│ │ PureSnitchHelper (root daemon) │ │
│ │ · pfctl anchor · DNS proxy · DoH upstream │ │
│ │ · blocklist sync · nettop/lsof · SQLite store │ │
│ └───────────────────────────────────────────────────┘ │
└────────────────────────────┬────────────────────────────┘
│
┌────────────────────▼────────────────────┐
│ macOS networking │
│ pfctl · DNS · bpf · ess · … │
└─────────────────────────────────────────┘Comparison
| PureSnitch | Little Snitch | LuLu | macOS Firewall | |
|---|---|---|---|---|
| Price | Free | Paid | Free | Bundled |
| License | MIT, open source | Commercial | GPL, open source | Apple, closed |
| Traffic graph / map UI | no live geo | ✓ | — | — |
| Rules browser | toggle/delete; alert-created rules | ✓ | basic | — |
| DNS proxy + DoH | experimental, manual | ✓ | — | — |
| Blocklists out of the box | 1Hosts, OISD, StevenBlack, HaGeZi | ✓ | — | — |
| pf-based IP/CIDR blocking | ✓ | ✓ | n/a | basic |
| Per-process kernel filtering | gated (NE entitlement) | ✓ | ✓ | — |
| Telemetry | none | none | none | n/a |
| Auditable source | yes | no | yes | no |
If per-process kernel filtering is a hard requirement today, use LuLu — it's free, open source and has the Network Extension entitlement. If you want the Little Snitch UI without buying a commercial license, PureSnitch is for you.
Screenshots
Process-level bandwidth, active connections, and summary pane. No live geolocation in v0.2.1.
All Rules / Active / Deny / Temporary / Unapproved, Rule Groups, Blocklists.
Install
brew trust momenbasel/puresnitch
brew install --cask momenbasel/puresnitch/puresnitchSigned and notarized DMG from the Releases page. Drag into /Applications.
brew install xcodegen
git clone https://github.com/momenbasel/puresnitch.git
cd puresnitch
xcodegen generate
xcodebuild -project PureSnitch.xcodeproj -scheme PureSnitch \
-configuration Release -derivedDataPath build \
CODE_SIGN_IDENTITY="-" \
CODE_SIGNING_REQUIRED=NO \
CODE_SIGNING_ALLOWED=NO \
build
open build/Build/Products/Release/PureSnitch.appThis certificate-free build launches the UI only. Live monitoring and enforcement require the privileged helper from the signed release or your own Developer ID signing setup.
FAQ
An independent open-source alternative with a deliberately similar UI. The blocking engine, DNS proxy and matcher are all written from scratch. No Little Snitch source, assets or proprietary plist formats are used. "Little Snitch" is a trademark of Objective Development Software GmbH; this project is not affiliated.
PureSnitch has no telemetry, analytics, or phone-home service. It fetches enabled blocklists at helper startup and on request. DNS reaches a DoH upstream only for clients manually configured to use the experimental proxy. The current release makes no live IP-geolocation requests.
Per-process blocking requires Apple's com.apple.developer.networking.networkextension entitlement and matching provisioning profiles. That path is not in the shipping build. Current pf rules are host-wide; DNS rules cover only manually configured proxy clients.
Yes. v0.2.1 is a universal binary with arm64 and x86_64 slices and requires macOS 13 (Ventura) or newer.
The experimental proxy accepts a custom DoH upstream, but each client must be configured to query the loopback proxy manually. PureSnitch does not alter system DNS or automatically layer itself over another resolver.
The host-wide pf anchor can interact with VPN routing or other firewall rules, so test your rules with the VPN enabled. The optional DNS proxy stays on loopback and PureSnitch does not replace VPN-provided DNS.
PureSnitch is free. Read the source. Fork it. Audit it.