6 ms·

What about the same for Linux? I would pay twice the LittleSnitch price for it if it was working really good.

by qwerty456127 6y ago

purrrfect 6y ago
You can use OpenSnitch on Linux. These days it's quite stable, they even have binaries.
- qwerty456127 6y ago
  Ok, thank you for a clue, I'll give it a try. The last time I checked it was clearly very far from production-ready. It still shouts "this software is a work in progress, do not expect it to be bug free and do not rely on it for any type of security" in all caps on its homepage which suggests it still is. Given all the abandoned attempts I've seen in the past I also feel very skeptical this one too.
  - phil294 6y ago
    Would you mind sharing your experience afterwards? The alternatives to SELinux in terms of network filtering seem to be so rare.
    - dijit 6y ago
      I can give you mine, since I use(d) opensnitch for a while. It works quite well but requires a GUI (obviously), it looks like it primarily supports GTK. If you're hoping to use the machine purely from the CLI (like, when sshing into your work machine) it won't work well. It is significantly less powerful than LittleSnitch, some options don't exist (like, allowing access to a domain), but you get similar functionality in many cases. Overall, it's definitely worth testing out to see if it works for you.
      - qwerty456127 6y ago
        > It is significantly less powerful than LittleSnitch To make it no-less powerfull somebody has to invest time and expertise into extending the kernel for it - AFAIK LittleSnitch works this way on MacOS.
      - gus_ 6y ago
        I think you haven't tested last versions. GUI is not GTK, but Qt. > If you're hoping to use the machine purely from the CLI (like, when sshing into your work machine) it won't work well. There's no cli tool published yet. There's a PoC though that works well. > some options don't exist (like, allowing access to a domain) Since version 1.0.0b you can filter by domain. And in latest version by domain, ip, network, uid, port, command line, command path, cmd environment variables, protocol, or any combination of them. You can't filter by interface, but if aomeone needs it open a new issue. > It is significantly less powerful than LittleSnitch What options do you miss?
robtherobber 6y ago
I'm aware no one asked, but in case anyone was scanning for Windows, simplewall is a reasonable alternative, both free and open source (development powered by donations): https://www.henrypp.org/product/simplewall https://www.henrypp.org/product/simplewall I'm not affiliated with them.
- qwerty456127 6y ago
  Thank you very much, I'll give it a try. I use Sphinx software Windows Firewall Control now.
- dhaavi 6y ago
  We're working on a powerful (also FOSS!) alternative for Windows. It includes DNS-over-TLS and extensive firewall features. See https://safing.io/portmaster/ https://safing.io/portmaster/ It's not completely stable yet, but we are making great progress. We'd love feedback!
  - robtherobber 6y ago
    Portmaster looks nothing short of amazing. I have tried it some two months ago but for couldn't really get along with it, I can't remember why. I should try it again, many thanks!
- ffpip 6y ago
  I use Glasswire. It's a good Windows firewall manager and network logger with a beatiful GUI. Some features are paid. https://www.glasswire.com/ https://www.glasswire.com/
kmlx 6y ago
iptables?
- qwerty456127 6y ago
  iptables don't let you know when a particular program tries to access an outside host and choose whether you want to allow that. Speaking of a desktop (not a server) firewall I'm rarely even interested which host/port/whatever is a connection about. What matters to me is what app initiated it (if it's initiated from outside my PC it should be always blocked). Iptables used to expose a field attributing a connection to a particular process but this feature was only available in old 2.4.x kernels IIRC.
  - dawnerd 6y ago
    Plus if you use docker iptables are essentially useless without a lot of tweaking to make docket respect it.
  - sleepybrett 6y ago
    Seems like you could do something with ebpf but how would you deal with the notifications in a cli env... special tty you connect to via tmux/screen?
    - qwerty456127 6y ago
      > but how would you deal with the notifications in a cli env That's a very interesting question. I'd love to invent something terminal-based for fun and for future occasions when I'm probably going to need that but I never actually needed that so far. I use GUI DEs 100% of time and I don't really care to firewall particular processes on remote servers I SSH to - those have other security policies doing the job pretty well for them. Perhaps it could be a named pipe a TUI app (TUI running in a separate virtual console, or in a terminal multiplexer) would connect to. Vuurmuur is an example of a nice TUI firewall app.
  - gruez 6y ago
    > iptables don't let you know when a particular program tries to access an outside host and choose whether you want to allow that. How does this model work for commonly used programs like curl? Do you block it and can't use it at all in your shell scripts, or do you whitelist it and hope that nefarious programs don't use it to exfiltrate data?
ignoramous 6y ago
OpenSnitch (Linux) works great, but you can also browse through: https://awesomeopensource.com/projects/firewall https://awesomeopensource.com/projects/firewall
dhaavi 6y ago
We're working on a powerful FOSS alternative for Linux. It includes DNS-over-TLS and extensive firewall features. See https://safing.io/portmaster/ https://safing.io/portmaster/ It's not completely stable yet, but we are making great progress. We'd love feedback!

What about the same for Linux? I would pay twice the LittleSnitch price for it if it was working really good.

purrrfect 6y ago

You can use OpenSnitch on Linux. These days it's quite stable, they even have binaries.

qwerty456127 6y ago
Ok, thank you for a clue, I'll give it a try. The last time I checked it was clearly very far from production-ready. It still shouts "this software is a work in progress, do not expect it to be bug free and do not rely on it for any type of security" in all caps on its homepage which suggests it still is. Given all the abandoned attempts I've seen in the past I also feel very skeptical this one too.
- phil294 6y ago
  Would you mind sharing your experience afterwards? The alternatives to SELinux in terms of network filtering seem to be so rare.
  - dijit 6y ago
    I can give you mine, since I use(d) opensnitch for a while. It works quite well but requires a GUI (obviously), it looks like it primarily supports GTK. If you're hoping to use the machine purely from the CLI (like, when sshing into your work machine) it won't work well. It is significantly less powerful than LittleSnitch, some options don't exist (like, allowing access to a domain), but you get similar functionality in many cases. Overall, it's definitely worth testing out to see if it works for you.
    - qwerty456127 6y ago
      > It is significantly less powerful than LittleSnitch To make it no-less powerfull somebody has to invest time and expertise into extending the kernel for it - AFAIK LittleSnitch works this way on MacOS.
    - gus_ 6y ago
      I think you haven't tested last versions. GUI is not GTK, but Qt. > If you're hoping to use the machine purely from the CLI (like, when sshing into your work machine) it won't work well. There's no cli tool published yet. There's a PoC though that works well. > some options don't exist (like, allowing access to a domain) Since version 1.0.0b you can filter by domain. And in latest version by domain, ip, network, uid, port, command line, command path, cmd environment variables, protocol, or any combination of them. You can't filter by interface, but if aomeone needs it open a new issue. > It is significantly less powerful than LittleSnitch What options do you miss?

robtherobber 6y ago

I'm aware no one asked, but in case anyone was scanning for Windows, simplewall is a reasonable alternative, both free and open source (development powered by donations): https://www.henrypp.org/product/simplewall https://www.henrypp.org/product/simplewall I'm not affiliated with them.

qwerty456127 6y ago
Thank you very much, I'll give it a try. I use Sphinx software Windows Firewall Control now.
dhaavi 6y ago
We're working on a powerful (also FOSS!) alternative for Windows. It includes DNS-over-TLS and extensive firewall features. See https://safing.io/portmaster/ https://safing.io/portmaster/ It's not completely stable yet, but we are making great progress. We'd love feedback!
- robtherobber 6y ago
  Portmaster looks nothing short of amazing. I have tried it some two months ago but for couldn't really get along with it, I can't remember why. I should try it again, many thanks!
ffpip 6y ago
I use Glasswire. It's a good Windows firewall manager and network logger with a beatiful GUI. Some features are paid. https://www.glasswire.com/ https://www.glasswire.com/

kmlx 6y ago

iptables?

qwerty456127 6y ago
iptables don't let you know when a particular program tries to access an outside host and choose whether you want to allow that. Speaking of a desktop (not a server) firewall I'm rarely even interested which host/port/whatever is a connection about. What matters to me is what app initiated it (if it's initiated from outside my PC it should be always blocked). Iptables used to expose a field attributing a connection to a particular process but this feature was only available in old 2.4.x kernels IIRC.
- dawnerd 6y ago
  Plus if you use docker iptables are essentially useless without a lot of tweaking to make docket respect it.
- sleepybrett 6y ago
  Seems like you could do something with ebpf but how would you deal with the notifications in a cli env... special tty you connect to via tmux/screen?
  - qwerty456127 6y ago
    > but how would you deal with the notifications in a cli env That's a very interesting question. I'd love to invent something terminal-based for fun and for future occasions when I'm probably going to need that but I never actually needed that so far. I use GUI DEs 100% of time and I don't really care to firewall particular processes on remote servers I SSH to - those have other security policies doing the job pretty well for them. Perhaps it could be a named pipe a TUI app (TUI running in a separate virtual console, or in a terminal multiplexer) would connect to. Vuurmuur is an example of a nice TUI firewall app.
- gruez 6y ago
  > iptables don't let you know when a particular program tries to access an outside host and choose whether you want to allow that. How does this model work for commonly used programs like curl? Do you block it and can't use it at all in your shell scripts, or do you whitelist it and hope that nefarious programs don't use it to exfiltrate data?

ignoramous 6y ago

OpenSnitch (Linux) works great, but you can also browse through: https://awesomeopensource.com/projects/firewall https://awesomeopensource.com/projects/firewall

dhaavi 6y ago

We're working on a powerful FOSS alternative for Linux. It includes DNS-over-TLS and extensive firewall features. See https://safing.io/portmaster/ https://safing.io/portmaster/ It's not completely stable yet, but we are making great progress. We'd love feedback!