On the cheaper side on the spectrum but not quite as cheap as TripMode, there is Vallum: https://vallumfirewall.com

I've been using it for years and the only feature I miss is domain/subdomain blacklisting.

If there is no need for such a granular control of outgoing connections for any given application, there's also the no-cost and open-sourced LuLu: https://github.com/objective-see/LuLu

So I love TripMode but it's a very different beast.

LittleSnitch = I want to monitor every connection every application makes.

TripMode = I want to disable Dropbox, Apple Software Update & Steam while on MyPhoneHotspot.

That being said, I wish there was an OpenTripMode, or... something on Linux.

Yeah, Little Snitch offers fine grained filtering control as it works at the "connection" level monitoring each and every connection, where as TripMode works at the "app" level only and either allows or blocks them from accessing the internet without any regards to the number of "connections" made or to whom the "connection" is made to.

And it works on broadband / fibre connections too, and not just for mobile data.

(Tip: Private Eye is a free software that allows you to monitor all connections made by any system or application softwares on your Mac. It's now bundled as part of another paid outbound firewall, similar to TripMode, called RadioSilence - https://radiosilenceapp.com/ but the free "monitoring only" version of Private Eye can still be found on the net).

I tried to install TrioMode for the bandwidth-monitoring features until I realized it actually needs to run in the kernel, which is too much of security trade off for me to accept.

I guess for bandwidth-monitoring alone that may seem like an overkill. But it's a firewall too. The TripMode FAQ does point out:

> TripMode uses a macOS feature called “Network Kernel Extension” to be able to block apps from accessing the Internet. This is the Apple-endorsed way of managing network traffic on a Mac ... We notarize each TripMode for Mac release with Apple, which means that Apple guarantees that they are free from malware ...

I also found this discussion that explains a bit about why Mac firewalls still prefer to use a Kernel Extension on macOS - https://forums.developer.apple.com/thread/79590 (The developers of all the three popular firewall mentioned here - Little Snitch, TripMode, RadioSilence - have added their thoughts in that thread).

Thanks for the link to TripMode. Didn't realize how much I need it. Always try to turn off apps when I'm tethered but somehow still eat up all my data.

Consider https://radiosilenceapp.com/ too - kind of similar to TripMode but has different feature set.