Skip to content

Generates Little Snitch rule files from cloud provider endpoint lists to automate outbound firewall rule updates.

License

Notifications You must be signed in to change notification settings

gavinmorrison/little-snitch-cloud-rules

Repository files navigation

🔒 Little Snitch Cloud Rules Generator

License: MIT Python 3.7+ GitHub Workflow Status Requests Last Updated macOS Compatible Little Snitch Compatible

This repository provides a Python script that fetches endpoint data from cloud service providers (initially only Microsoft) and generates Little Snitch rule files to allow or restrict outbound traffic.


Overview

This script:

  • Fetches official cloud service provider endpoint lists (currently Microsoft; future expansion possible).
  • Extracts relevant URLs and IPs.
  • Generates a .lsrules rule file formatted for Little Snitch on macOS.
  • Supports updating rules using GitHub Actions, ensuring rule files stay up-to-date.

Features & Limitations

New Features:

  • Automated rule generation: GitHub Actions runs the script daily to fetch updated endpoint lists.
  • Port-specific rule generation: Optionally generate separate rules for TCP and UDP ports.
  • Enhanced URL handling: Wildcard domains are correctly processed (mostly).

Limitations:

  • Wildcard limitations: Only leading wildcards are supported (e.g. *.microsoft.com); as of March 2025, this impacts two URLs: autodiscover.*.onmicrosoft.com and *cdn.onenote.net.
  • Provider support: Currently, only Microsoft Cloud endpoints are supported.
  • No granularity: Currently, any of the 'allowed' endpoints will be added, with no options for granularity.

Supported Cloud Providers

Provider Status API Used
Microsoft (Office 365, Entra ID, etc.) ✅ Supported Microsoft Endpoint API

Why Use This?

If you use Little Snitch on macOS and rely on cloud services, this script helps you:

  • Automate rule creation for outbound network access.
  • Easily update firewall rules when endpoints change.

Prerequisites

Install dependencies:

pip install requests

Disclaimer

This project is not affiliated with, endorsed by, or associated with Objective Development or Little Snitch in any way. Little Snitch is a product of Objective Development Software GmbH.

Use at Your Own Risk This script should not be relied upon to reliably update your firewall rules and should not be relied upon for security or compliance purposes. The generated rules are based on publicly available data but may be incomplete, outdated, or incorrect. Users should manually verify all rules before applying them.

Self-Hosting Recommended If you intend to use these rules regularly, it is strongly recommended that you host your own version of this script or fork this repository to ensure control over updates.

License

This project is licensed under the MIT License - see the LICENSE file for details.

About

Generates Little Snitch rule files from cloud provider endpoint lists to automate outbound firewall rule updates.

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Contributors 2

  •  
  •  

Languages