@lapcatsoftware in regards to little snitch. I replied previously, but this behavior I would expect. little snitch is functioning at what seems to be the user level. In order to restrict what you I think you describing you need to do at the packet level. (Via pf) and something like Murus would do that.