OpenSnitch

OpenSnitch watches every outbound connection and asks you, per application, whether to allow it — building a ruleset that reveals exactly which processes phone home and lets you block them. For the privacy-conscious switcher who ran GlassWire or Little Snitch, this is the equivalent, complete with a network activity view and rule editor.

The first days are noisy: modern systems make a lot of legitimate connections, and you’ll be training rules constantly until it settles. Rules are per-executable-path, so updates and Flatpak sandbox paths can require re-answering. It adds a small performance cost to network syscalls and, like all such tools, is only as good as your judgment when you click Allow.