Change one rule at a time
Test the app after each change so you can identify which connection it needs.
Choose where to start
Download LuLu from Objective-See. Open the disk image, move LuLu to Applications, then launch it.
Download LuLu ↗
Review the automatic allow settings. If you want prompts for installed apps, check whether they already have permission or an existing allow rule.

Open the app and trigger an online action. When an alert appears, check the process name and choose Block.

Open Rules from LuLu’s menu-bar icon. Find your app and edit or remove its block rule whenever you want to restore access.

Block connections initiated by other devices. This does not stop the app accessing the internet.
Open Apple menu → System Settings → Network → Firewall.
Turn on Firewall, then open Options to manage incoming connections for individual apps.
Click the add (+) button, select the app and add it to the list. Use the menu beside the app to choose Block incoming connections, then click OK.
Return to Firewall → Options whenever you want to change the app’s setting. Choose Allow incoming connections to permit them again.
Yes. LuLu is a free, open-source firewall from Objective-See.
Yes. Open LuLu’s Rules window, find the app, then edit or remove its block rule.
Local features may still work. Features that need the internet, such as cloud sync and downloads, will not work while their connections are blocked.
The app may already have an allow rule or be covered by automatic allow settings. Check its rules and LuLu’s settings.
No. A rule for one app applies to that app’s connections. Other apps can continue using the internet.
Test the app after each change so you can identify which connection it needs.
An app may use a separate helper process. Check the process named in the alert before creating a rule.
Record which rules you changed so you can restore access later.