Blocking all apps

[engineer-plus-plus]

Is there a way to block all apps from connection to a given host? I would expect that putting * in program path in a rule definition would do that. But not such luck. Is there another way?

[objective-see]

Creating a rule with * should work? (Though if it doesn't let's troubleshoot/get that fixed!)

These are the steps I took to test this (using a block google.com), which seems to work as intended?

1. Add rule, setting * for Program Path:
   

2. Rule is created:
   

3. Via curl, now try to connect to google.com:

curl: (7) Failed to connect to google.com port 80 after 42 ms: Couldn't connect to server

4. Which is also confirmed by the logs:

% log stream --level debug --predicate="subsystem='com.objective-see.lulu'"

looking for rule for com.apple.curl -> /usr/bin/curl
rule port is any ('*'), will check host/url
checking rule's endpoint address (google.com) and rule's endpoint host google.com against (
    "142.250.191.78",
    "google.com"
)
....
rule match (endpoint address): google.com
found matching rule for 57739/curl: RULE: pid: all, path: *, name: *, code signing info: (null), endpoint addr: google.com, endpoint port: *, 

setting verdict to: BLOCK

Of course if this isn't working for you, let me know! (Note, there are some limitations on hosts, for example macOS doesn't always pass them to LuLu, but the logs will show this)