3 ms·

Yet another case where gateway firewalls can give you back some of the privacy that these companies attempt to wrench away from you. PfSense is a free gateway

Yet another case where gateway firewalls can give you back some of the privacy that these companies attempt to wrench away from you. PfSense is a free gateway firewall but the UI left much to be desired last I checked. Another option is the Sophos UTM, which has a firewall, web filter, and VPN server built into one. Gateway protections are your last resort when it comes to protecting yourself from shady behavior like this.

dijit 11y ago
gateways don't help when you're a mobile user. which is why I have little snitch on my mac... I'm not _always_ going to be using my laptop at home- and that's increasingly true for my mobile phone which is almost never left home.
- ac29 11y ago
  They do if you connect to them via VPN.
- click170 11y ago
  Always-On VPN. I won't buy a phone that doesn't have that feature.
  - storrgie 11y ago
    You've missed the entire original point. It doesn't matter that you're tunneling traffic through some non-local endpoint, the point is that the traffic shouldn't leave your device by default.
    - gcb0 11y ago
      but you have control on the vpn side. i still have one question in a forum about why Android browser's ignore etc/hosts, and every now and then (question is 6 years old) people comment how shocked they are to discover that is the case (still!)
      - tjoff 11y ago
        No you don't. How would you filter traffic based on apps on the vpn side? Or feature? I'd love a firewall rule that could block any traffic that contains my contact list. Wouldn't be possible even if the traffic wasn't encrypted...
        jon-wood 11y ago
        Sure you could - have a contact on your phone called something like 000-alarm and filter any requests containing that string. Its not foolproof, but it certainly isn't impossible. Maybe scatter a few of these contacts through the alphabet to catch apps sending in batches.
        kbenson 11y ago
        That doesn't help if they are encrypting the data before sending it. As responsible developers they wouldn't want to send your entire address book across the wire in the clear, would they? Why, someone could easily listen in and then you would have no privacy! /sarcasm.
        stefanix 11y ago
        Like fixing a boat hull with duct tape. Totally possible if you don't care about water in the boat.
      - SturgeonsLaw 11y ago
        > i still have one question in a forum about why Android browser's ignore etc/hosts To make it harder to write an ad blocker
    - click170 11y ago
      Using your gateway is what you do when you lose the ability to apply restrictions on your phone. And since this thread is in response to recent changes in android that remove users ability to control the apps on their phone I thought that was implied. Of course its ideal to not send the packets and waste the battery at all but when that's not an option, I'd rather use a firewall to block the traffic rather then just let it through, regardless of the hit to the battery due to it constantly retrying the blocked connection.
anonbanker 11y ago
PFsense has an amazing GUI. what problems did you experience?
- click170 11y ago
  The menu items were not grouped logically, eg in order to change something in one feature I had to browse through every single config page in order to find the related options. It was possible to do, and PFSense Support was phenomenal (by chance the co-founder answered the phone when we called Support), but the UI left much to be desired. Compared to my experiences with the Sophos UTM, it's downright painful. With the UTM the UI elements of every part of a service are grouped together, and are duplicated in sections where it's intuitive to do so. Eg Certificate Management can be found in multiple places in the UTM but all things related to the web filter are in one place, all things related to routing are in one place, et al.
  - tjoff 11y ago
    I wholeheartedly agree. I'm sure the GUI works great for anyone used to it but it really is not logical, I simply can not count the times or frustrations I've had, going through each menu reading each item just to find that darn feature I was after. Luckily they are redesigning the GUI for the next version, I'm hopeful that they will rearrange it as well (even though that will obviously be awkward for everyone already familiar with it) but I don't know, haven't paid attention to the development. Case in point: Reboot, shutdown and Backup/Restore ought to be under the "System" menu, right? Nope. It's under Diagnostics, which is a large alphabetically sorted list (not by functionality or anything else, so if you are unsure of which term was used, well, you're better off consulting google).
    - click170 11y ago
      Thank you for highlighting that they are redesigning the UI. I much prefer to support PFSense because they seem more supportive of their community, I will be looking forward to trying out their new UI when its out!

dijit 11y ago

gateways don't help when you're a mobile user. which is why I have little snitch on my mac... I'm not _always_ going to be using my laptop at home- and that's increasingly true for my mobile phone which is almost never left home.

ac29 11y ago
They do if you connect to them via VPN.
click170 11y ago
Always-On VPN. I won't buy a phone that doesn't have that feature.
- storrgie 11y ago
  You've missed the entire original point. It doesn't matter that you're tunneling traffic through some non-local endpoint, the point is that the traffic shouldn't leave your device by default.
  - gcb0 11y ago
    but you have control on the vpn side. i still have one question in a forum about why Android browser's ignore etc/hosts, and every now and then (question is 6 years old) people comment how shocked they are to discover that is the case (still!)
    - tjoff 11y ago
      No you don't. How would you filter traffic based on apps on the vpn side? Or feature? I'd love a firewall rule that could block any traffic that contains my contact list. Wouldn't be possible even if the traffic wasn't encrypted...
      - jon-wood 11y ago
        Sure you could - have a contact on your phone called something like 000-alarm and filter any requests containing that string. Its not foolproof, but it certainly isn't impossible. Maybe scatter a few of these contacts through the alphabet to catch apps sending in batches.
        kbenson 11y ago
        That doesn't help if they are encrypting the data before sending it. As responsible developers they wouldn't want to send your entire address book across the wire in the clear, would they? Why, someone could easily listen in and then you would have no privacy! /sarcasm.
        stefanix 11y ago
        Like fixing a boat hull with duct tape. Totally possible if you don't care about water in the boat.
    - SturgeonsLaw 11y ago
      > i still have one question in a forum about why Android browser's ignore etc/hosts To make it harder to write an ad blocker
  - click170 11y ago
    Using your gateway is what you do when you lose the ability to apply restrictions on your phone. And since this thread is in response to recent changes in android that remove users ability to control the apps on their phone I thought that was implied. Of course its ideal to not send the packets and waste the battery at all but when that's not an option, I'd rather use a firewall to block the traffic rather then just let it through, regardless of the hit to the battery due to it constantly retrying the blocked connection.

anonbanker 11y ago

PFsense has an amazing GUI. what problems did you experience?

click170 11y ago
The menu items were not grouped logically, eg in order to change something in one feature I had to browse through every single config page in order to find the related options. It was possible to do, and PFSense Support was phenomenal (by chance the co-founder answered the phone when we called Support), but the UI left much to be desired. Compared to my experiences with the Sophos UTM, it's downright painful. With the UTM the UI elements of every part of a service are grouped together, and are duplicated in sections where it's intuitive to do so. Eg Certificate Management can be found in multiple places in the UTM but all things related to the web filter are in one place, all things related to routing are in one place, et al.
- tjoff 11y ago
  I wholeheartedly agree. I'm sure the GUI works great for anyone used to it but it really is not logical, I simply can not count the times or frustrations I've had, going through each menu reading each item just to find that darn feature I was after. Luckily they are redesigning the GUI for the next version, I'm hopeful that they will rearrange it as well (even though that will obviously be awkward for everyone already familiar with it) but I don't know, haven't paid attention to the development. Case in point: Reboot, shutdown and Backup/Restore ought to be under the "System" menu, right? Nope. It's under Diagnostics, which is a large alphabetically sorted list (not by functionality or anything else, so if you are unsure of which term was used, well, you're better off consulting google).
  - click170 11y ago
    Thank you for highlighting that they are redesigning the UI. I much prefer to support PFSense because they seem more supportive of their community, I will be looking forward to trying out their new UI when its out!