I am finding that certain apps (on Monterey) are not being filtered. These are native apple apps. Even if I disable network access, on reboot, it resets. When I deny access, it adds another deny rule. That results in 2 rules, one saying allow the other saying deny.

This can happen in pf like firewalls as well, but pf has strict rules on how any line will be evaluated from top to bottom.

How does lulu evaluate rules from top to bottom? Will it take the topmost rule and stop evaluating rules at the bottom, for the same program?

P.S. I do see that certain apple programs are not bypassing Lulu and LittleSnitch firewalls: https://news.ycombinator.com/item?id=24838816