VPN, proxy and filters

Little Snitch, LuLu and other network extensions conflict on a Mac

Firewalls, VPNs and content filters on macOS use network extensions. When several of them run, one of them can block or redirect traffic that another needs.

Applies to: macOS 15 Sequoia and later for the Login Items & Extensions path. Earlier versions show these extensions in other places.Checked: 29 October 2026

Symptoms

Connections fail after you install a firewall, VPN, antivirus or parental control app.
A VPN connects, but no traffic goes through it while a firewall app runs.
An app connects only when you quit another network app.
macOS asks again to allow a filter or a VPN configuration.

Likely causes

Two filters or firewalls. Each filter can block a connection. A block rule in one app stops the connection, even if another app allows it.
A VPN with strict firewall rules. Many VPNs block all traffic that does not go through their tunnel. This can block another VPN or a local network tool.
An old extension. An app that you removed can leave its extension or configuration on the Mac.
A rule that you forgot. A rule in a firewall app can block one app or one host for a long time.

How to check

Choose Apple menu > System Settings > General > Login Items & Extensions.
Find Network Extensions. Click the Info button to see which network extensions are on.
Choose Apple menu > System Settings > Network. Look for VPN and filter configurations that you do not use.
List the VPN services that macOS knows.
```
scutil --nc list
```
Open each firewall app and look at its recent blocked connections.

How to fix it

Turn off the filter in each firewall app from its own menu. For example, Little Snitch and LuLu have this control.
Test the connection after you turn off each app. Do one change at a time.
When you find the app that blocks, change its rule or its settings. Then turn its filter on again.
To remove an extension, use the uninstaller or the remove command of its app.
In Login Items & Extensions, click the Info button for Network Extensions. Turn off the extension that you do not use. Then click Done.
Restart the Mac after you remove a VPN or filter extension.

With Kilobat

Kilobat also uses a network filter for its rules. Its connection check names the Kilobat rule that applies to a host.
```
kilobat why example.com --app com.example.App
```
See what Kilobat's filter blocked, with the reason for each block.
```
kilobat blocked-history
```
To stop Kilobat's rules without removing them, switch to the Unrestricted profile.
```
kilobat profile unrestricted
```
To remove the filter, open Kilobat Settings and choose Remove Kilobat. Blocking needs Pro, but these steps are free.

Questions

Can I use two firewalls at the same time?

macOS lets several network extensions run. Each one can block traffic, so a connection must pass all of them. Use one firewall if you can.

Does turning off the filter remove the app?

No. In Little Snitch and LuLu, the filter switch stops filtering. The app stays installed.

Sources

Apple Support: Change Login Items & Extensions settings on Mac
Tailscale: Interoperability with other software
Objective-See: LuLu
Little Snitch 6 Help: General settings
scutil(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with man <name> in Terminal.