The short answer
In Little Snitch, select the rules and choose File › Export Selected Rules… to save an .lsrules file. In LuLu, click its menu bar icon and choose Rules › Export…. Then in iKnowMyMac 1.7 or later, with Traffic on, choose File › Import Rules…, pick the file and click Preview. The preview lists what will be imported, what is already in your rules and what is skipped, with the reason, and nothing is added until you click Import. Imported rules apply while Blocking is on.
On this page
Before you start
- iKnowMyMac 1.7 or later, with Traffic on. Import Rules… works while Traffic is on, in Settings › Traffic.
- Blocking applies the rules. Imported rules do nothing until Blocking is on, and Blocking needs Traffic's network filter. The help centre has the steps for both.
- Nothing is closed. Importing never closes an open connection: you see the rules in Traffic › Rules first.
Export your rules from Little Snitch
These steps are the same in Little Snitch 6 and in the Little Snitch 7 beta:
- Open Little Snitch's Rules window.
- Select the rules you want to bring. To take them all, click one rule and press ⌘A.
- Choose File › Export Selected Rules….
- Choose where to save it. Little Snitch saves the rules as an .lsrules file, in JSON.
Export your rules from LuLu
- Click LuLu's icon in the menu bar.
- Choose Rules › Export….
- In the Save dialog, tick Only export user created rules if you want only the rules you made. LuLu's built-in allow rules are skipped by iKnowMyMac either way.
- Click Save. LuLu proposes rules.json, on your Desktop.
Import them into iKnowMyMac
- In iKnowMyMac, choose File › Import Rules…, or click Import… in Network › Traffic › Rules.
- Choose the .lsrules or .json file, then click Preview.
- Read the preview. It has three groups: the rules to import, those already in your rules, and those skipped, each with the reason. A rule that changes a little on the way, such as one now matched by its path, says so.
- Click Import, which says how many rules: for example, Import 41 Rules.
- Open Network › Traffic › Rules. The rules are in the Imported group (Imported from Little Snitch, or from LuLu), where each can be switched off, edited or deleted, and a line at the top says how many were imported, merged and skipped, with Review to see the preview again.
- If Blocking is off, turn it on: in Settings › Traffic › Blocking, or with the Blocking off button in Traffic's header.
What is imported, merged or skipped
iKnowMyMac's rules know a program by its code signature and hold one destination each, so some rules change shape on the way in. Nothing is widened: a rule that can't be written the same way is skipped, with the reason.
| In the file | In iKnowMyMac | Why |
|---|---|---|
| A program on this Mac with a Team ID, or a Little Snitch code ID (TEAMID/identifier, APPLE/identifier) | Matched by its code signature | Rules know programs by Team ID and signing ID |
| A program not on this Mac, unsigned or ad hoc | Matched by its path, with a note | Any build at that path matches |
| Several hosts, domains or addresses in one rule | One rule for each | A rule holds one destination |
| An address range, from one address to another | The fewest networks that cover it exactly, up to 32 | Rules hold an address or a network |
| “local-net” or “multicast” | The private or multicast address ranges, with a note | The closest fixed equivalent |
| An incoming rule | An incoming rule | Rules have a direction |
| A block rule for every process and every destination | Imported switched off | So turning on Blocking can never cut the Mac off |
| Little Snitch's denied hosts, domains or addresses | Block rules for any process; a list of more than 1,000 is skipped | Long lists belong in blocklists |
| “High” priority | Imported, with a note | Rules here are ordered by how specific they are |
| LuLu's “process and its children” | The program itself, with a note | No rule for every process a program starts |
| The same as one of your rules, or covered by one of your enabled rules with the same action | Already in your rules | Not added twice |
| A rule set to ask, or with no action | Skipped | iKnowMyMac asks only through its guards |
| A rule for an app using a helper tool (“via”) | Skipped | No equivalent |
| “broadcast”, “bonjour”, “dns-servers” or “bpf” | Skipped | No equivalent |
| A port range, or a protocol other than TCP or UDP | Skipped | A rule takes one port or any port, TCP or UDP |
| Little Snitch code IDs that start ADHOC/, SHA256/ or KEY/ | Skipped | Nothing here can match them |
| LuLu's built-in allow rules (default, Apple, baseline) and passive-mode rules | Skipped | iKnowMyMac allows these connections already |
| LuLu folder rules, regular expressions, patterns other than *.domain, and temporary rules | Skipped | No equivalent |
A program on this Mac with a Team ID, or a Little Snitch code ID (TEAMID/identifier, APPLE/identifier)
- In iKnowMyMac
- Matched by its code signature
- Why
- Rules know programs by Team ID and signing ID
A program not on this Mac, unsigned or ad hoc
- In iKnowMyMac
- Matched by its path, with a note
- Why
- Any build at that path matches
Several hosts, domains or addresses in one rule
- In iKnowMyMac
- One rule for each
- Why
- A rule holds one destination
An address range, from one address to another
- In iKnowMyMac
- The fewest networks that cover it exactly, up to 32
- Why
- Rules hold an address or a network
“local-net” or “multicast”
- In iKnowMyMac
- The private or multicast address ranges, with a note
- Why
- The closest fixed equivalent
An incoming rule
- In iKnowMyMac
- An incoming rule
- Why
- Rules have a direction
A block rule for every process and every destination
- In iKnowMyMac
- Imported switched off
- Why
- So turning on Blocking can never cut the Mac off
Little Snitch's denied hosts, domains or addresses
- In iKnowMyMac
- Block rules for any process; a list of more than 1,000 is skipped
- Why
- Long lists belong in blocklists
“High” priority
- In iKnowMyMac
- Imported, with a note
- Why
- Rules here are ordered by how specific they are
LuLu's “process and its children”
- In iKnowMyMac
- The program itself, with a note
- Why
- No rule for every process a program starts
The same as one of your rules, or covered by one of your enabled rules with the same action
- In iKnowMyMac
- Already in your rules
- Why
- Not added twice
A rule set to ask, or with no action
- In iKnowMyMac
- Skipped
- Why
- iKnowMyMac asks only through its guards
A rule for an app using a helper tool (“via”)
- In iKnowMyMac
- Skipped
- Why
- No equivalent
“broadcast”, “bonjour”, “dns-servers” or “bpf”
- In iKnowMyMac
- Skipped
- Why
- No equivalent
A port range, or a protocol other than TCP or UDP
- In iKnowMyMac
- Skipped
- Why
- A rule takes one port or any port, TCP or UDP
Little Snitch code IDs that start ADHOC/, SHA256/ or KEY/
- In iKnowMyMac
- Skipped
- Why
- Nothing here can match them
LuLu's built-in allow rules (default, Apple, baseline) and passive-mode rules
- In iKnowMyMac
- Skipped
- Why
- iKnowMyMac allows these connections already
LuLu folder rules, regular expressions, patterns other than *.domain, and temporary rules
- In iKnowMyMac
- Skipped
- Why
- No equivalent
An import takes up to 5,000 rules from a file of up to 16 MB. An .lsrules file has no profiles, so every imported rule applies everywhere, as in Little Snitch's default profile. To keep one for untrusted networks only, edit it in Rules and choose Only on untrusted networks, then mark the networks you trust in Settings › Traffic › Blocking › Trusted networks. The first time you trust a Wi-Fi network, iKnowMyMac asks macOS for Location, to read the Wi-Fi name; nothing else.
What works differently in iKnowMyMac
- No alert for every connection. Everything is allowed until a rule, a blocklist set to Block or a guard says otherwise. Install Guard asks when an install reaches outside its registries, Agent Guard when an AI agent session contacts a domain no agent has used before; Unsigned Guard and New App Guard are there if you want them. If nobody answers, a guard lets the connection go after its time.
- No profiles. Mark the networks you trust; a rule can apply everywhere or only on the others.
- Blocking works while iKnowMyMac is running. When it quits, connections are allowed again within seconds. Turning on Blocking also turns on Open at login, so it starts every time you log in; untick it in the sheet to leave it off.
- Big lists are blocklists. Turning on Blocking ticks Block malware (HaGeZi Threat Intelligence Feeds) and Block trackers (EasyPrivacy), set to Block; untick either one. NoCoin is in Settings › Traffic › Blocklists, with room for your own lists by address.
- Explain stays on your Mac. Ask about any connection: Apple's on-device model answers, and nothing is sent.
Taking your rules back out
File › Export Rules for Little Snitch… writes your rules as an .lsrules file. Rules that Little Snitch can't express are left out rather than widened: rules with a “started by” or agent session condition, rules for untrusted networks only and temporary rules. A rule for all processes of an app is written for the app's main program. After saving, iKnowMyMac lists what it left out or changed. File › Export Rules… writes iKnowMyMac's own JSON, which imports back as it was.