Concept app · v0.1.0 · Notarized

Gjallarhorn

A network filter for the Mac, for people who run Macs for an organisation. It shows every connection, can ask before new ones and block the ones you deny, shows how a connection travels (DNS, proxy, content filters, VPN), tests why a destination does not work, and turns what it sees into configuration for Jamf Pro or Intune. Named after the horn that Heimdall blows to warn the gods.

Concept app. Gjallarhorn explores what a per-connection network filter looks like when the Mac is managed: visibility first, rules you can preview, and a profile that can force everything. Version 0.1.0 is signed and notarized. It has been tested with demo data and for a day on one MDM-managed work Mac (Jamf schema, package deployment, managed rules and modes), not at scale, so try it on test Macs and in monitor mode first.

Download Gjallarhorn (2.8 MB) Read the Docs

Gjallarhorn Connections window in ask mode with made-up demo connections: allowed and denied results, who decided, and the path of the selected connection

Features

See what your Macs connect to, then decide

🔌

Every Connection

Each new connection with app, destination, port and decision. Wireshark-style filter expressions (ip.addr == 192.* && port == 443), a list that follows live or holds still while you read it, a flow pane per row, CSV and JSON export.

❓

Ask Before It Connects

Modes: monitor only, ask, allow everything for a while, block everything, or block list (everything allowed except what a Deny rule matches, for "no IPv6", "no FTP", "no Telnet"). One panel for everything that is waiting.

📏

Rules With a Preview

Per app, developer or every app; per host, domain, address range, port or range, service, IP version and transport; time-limited. Import and export as CSV, JSON or a profile. A preview replays the recorded connections against a rule set before it is enforced.

🧭

The Path of a Connection

App, DNS, proxy and PAC, content filters, route or VPN, destination: where it fails, and which component wins. Gjallarhorn shows its own decision first; the order of the stages is not yet verified against several other filters.

🌐

Network Overview

Content filters, VPNs, system extensions, proxy and PAC, DNS, a TLS-inspection check, and Test a destination: resolve, connect, TLS handshake, and what the filter did with it.

⏺️

Recording

Administrators can record the bytes of one app's next connections (time and size limited) and save them as a file Wireshark opens. The payload is real, the packet headers are synthetic, TLS stays encrypted.

🔒

Managed Devices

A configuration profile can force rules, mode and visibility. The app can hide itself completely, and keys, prompts, retention and block messages are configurable. Connection history is visible to administrators only.

🛟

Stays Manageable

Five Apple management processes stay reachable in block mode (identified by Apple's signature, not by name), so a Mac in block mode can still receive its next profile. A helpdesk unlock with signed one-time codes is the last resort.

📤

Turns What It Sees Into Configuration

Rule sets export as CSV, JSON or a profile for Jamf Pro or Intune, with a Jamf Pro schema, an example allowlist profile, a deployment profile and a status extension attribute.

📑

PDF Report

A report for other teams from Connections or Network. Dense and plain, in light and dark mode.

⌨️

Command Line

--cli with info, status, rules, history, mode, policy, add-rule, path, test, tls, simulate, report, capture and unlock commands, for extension attributes and remote sessions.

🕵️

No Telemetry, No AI

Rules, history and recordings stay on the Mac in root-only files. This version has no AI and no accounts.

See It In Action

From connection list to rule

Connections in ask mode: every connection with app, destination, decision and who decided, and the path of the selected one.

Connections: result first, then who decided (managed rule, your rule, built in), and the path of the selected row.

Network tab: content filters, VPN, system extensions, proxy and PAC, DNS and the test-a-destination field.

Network: what else on this Mac filters, proxies or resolves, and a test for a destination.

The prompt panel listing four waiting connections and asking whether Safari may connect to github.com

Prompt panel: everything waiting in one list, with a remembered rule and a time-out.

Rules: managed rules that cannot be changed on the Mac, and your own.

Rule preview replaying recorded connections against a rule set

Preview: what a rule set would have done to the connections already recorded, before it is enforced.

Applications tab with exact hit counts and Allow or Deny menu

Applications: a growing list with exact hit counts and a one-menu Allow or Deny.

Connections with the details switched on: the path of the selected connection stage by stage

Path details: switched on, every stage of the selected connection with what was found and in which order.

Settings window grouped into questions, history, reports and the network filter

Settings: how long a question waits, what happens when nobody answers, history, reports and the state of the filter. Settings your organisation manages are locked.

All screenshots show made-up demo data (example domains, a fictional "Northwind" network). Nothing from a real Mac or organisation.

Status

Where things stand

System Requirements

macOS 26 or later, Apple silicon only.

The first start installs the network extension; macOS asks for approval unless the deployment profile is installed first (needs a user-approved MDM enrolment or supervision).

Build Status

Version 0.1.0. Signed with a Developer ID certificate and notarized by Apple. The package is 2.8 MB, SHA-256 e87618a3…e0e08.

176 unit tests pass (Swift 6, strict concurrency).

What's Verified

Tested with demo data and for a day on one MDM-managed work Mac: the Jamf schema, package deployment, managed rules and modes. Not yet tested on a managed Mac: hidden mode, helpdesk unlock, the audit log and recording under a profile (those were run on an unmanaged Mac). The order of the path stages is unverified against several other content filters.

Known Limit

Until macOS has started the network extension after a restart, the Mac is not filtered. That is the operating system's start-up order, not a setting. The app reports how many seconds after boot the filter started.