10 ms·

Portmaster 1.0 – Open-Source Network Monitor and Privacy Firewall

311 points by dhaavi 4y ago

dhaavi 4y ago
CTO and Co-Founder of Safing here. We're super excited to introduce version 1.0 of our network monitor and privacy firewall - Portmaster! On 1.1. this year, Portmaster was shared on HN and we hit front page [1]. With the help of our testers - many of you! - we were able to mature and develop Portmaster to hit this milestone. We're on a mission to bring privacy back to the masses. Privacy has to be easy & accessible for everyone, while hackers and tinkerers should have the tools to customize everything to their needs. So while Portmaster 1.0 is a big milestone, this is just the start! [1]: https://news.ycombinator.com/item?id=29761978 https://news.ycombinator.com/item?id=29761978 [2]: https://star-history.com/#safing/portmaster&Date https://star-history.com/#safing/portmaster&Date
- OrvalWintermute 4y ago
  Looks intriguing. A few questions: (1) Are you planning on having support for more than 5 devices at a future point? (2) Will you have any features to support parents protection of their children? (3) How easy is it to integrate Safing into a home security stack, or an enterprise security stack? (4) Have you considered a one-time unlimited buy-in level in lieu of monthly? (5) Is this coming for iOS & MacOS? Thanks for pushing the privacy front.
  - dhaavi 4y ago
    Thanks for your interest. (1) Are you planning on having support for more than 5 devices at a future point? 5 devices is what we estimate 1 user has (avg max). If there is demand, we will definitely add a plan to support more devices (or users). (2) Will you have any features to support parents protection of their children? We already collect NSFW filter lists to be activated in the settings. Otherwise such features are tricky, as we need to start protecting against the person in front of the device, which is very hard. If you have suggestions, please share! (3) How easy is it to integrate Safing into a home security stack, or an enterprise security stack? Can you elaborate on what exactly you have in mind? We don't offer any integrations with other system out of the box yet. We have APIs though that you can use. (4) Have you considered a one-time unlimited buy-in level in lieu of monthly? We had a couple lifetime plans on our Kickstarter (years ago). Right now, we don't have any plans for this. You can pay in advance though - up to 4 years. (5) Is this coming for iOS & MacOS? Yes. Or, at least we will attempt. Going to be "fun" if Apple continues their locking down strategy. Maybe the EU will force them to open up until then. Expect at least 1-2 years for this to land though.
    - mdip 4y ago
      Rather insightful on (2) with regard to: > ... we need to start protecting against the person in front of the device My first thought was, "Oh, God, please don't". I'm a parent, if I put that software on the computer it comes with rules not to touch it; if it's touched, they know I'll probably find out, ban them from it for a bit and return it to them locked down in a manner that when I return it to its original state, they won't touch it again. :o). But then I thought of the other common reason this kind of capability is added to software -- are you preparing for the eventual future where you will have to do this, not to protect from a child removing the software, but to protect from another app surreptitiously removing Portmaster in order to bypass its protections?
      - dhaavi 4y ago
        Yes. Good points. Well, the first thing we might do is just a "Only an Administrator can make changes." setting where you only admin accounts are allowed to change settings. This one makes sense. Everything beyond that gets complicated and easy to circumvent fast. (I also think the original question was more about blocking features and the likes.) Protecting against other software is related, but also different. We have some decent protection here, albeit not against simply shutting Portmaster down.
    - OrvalWintermute 4y ago
      >(1) Are you planning on having support for more than 5 devices at a future point? >5 devices is what we estimate 1 user has (avg max). If there is demand, we will definitely add a plan to support more devices (or users). I'd estimate for a family plan (my case) we'd have 5 users. Given that I am on HN and part of the technocrati collective we have a ton of devices, particularly once your iOS & Mac OS coverage kicks in too. >(2) Will you have any features to support parents protection of their children? >We already collect NSFW filter lists to be activated in the settings. Otherwise such features are tricky, as we need to start protecting against the person in front of the device, which is very hard. If you have suggestions, please share! I think it would be person in front of the device, but a NSFW filter list is the min requirement, sounds like you already meet that. >(3) How easy is it to integrate Safing into a home security stack, or an enterprise security stack? >Can you elaborate on what exactly you have in mind? We don't offer any integrations with other system out of the box yet. We have APIs though that you can use. Aggregating logs across all devices protected. I don't know if syslog would be best, as there are options Unified console for centralized control of all instances would be a stretch goal
- runlevel1 4y ago
  Congrats on releasing 1.0! It looks very cool. A few questions about Portmaster Unlimited and SPN: 1. Does Safing own and operate all the exit nodes or can folks add their own nodes to it? 2. Are you self-hosting the exit nodes? If not, I'm curious what cloud providers you use. 3. Have you found egressing through a bunch of different geolocated IPs for the same request triggers DDoS/anti-scraping systems (like Cloudflare) more than usual?
  - dhaavi 4y ago
    Thanks! 1. Does Safing own and operate all the exit nodes or can folks add their own nodes to it? Everyone can join. We also plan to compensate in some way in the future. Docs: https://docs.safing.io/spn/hosting-a-community-node https://docs.safing.io/spn/hosting-a-community-node 2. Are you self-hosting the exit nodes? If not, I'm curious what cloud providers you use. We rent servers. If you have the SPN, you can click on every server on the map and check where it is hosted. Currently mainly Hetzner, OVH, Katamera, HostHatch. We regularly try new providers, rent a couple servers and see how it goes. 3. Have you found egressing through a bunch of different geolocated IPs for the same request triggers DDoS/anti-scraping systems (like Cloudflare) more than usual? The client "pins" destination domains/IPs to an exit for an hour (scoped per app) in order to get more stability here. We had issues in the past.
- csdvrx 4y ago
  Congrats! Just one question: In the past, postmaster had problems with WSL2. I documented the issue and the solution: https://www.reddit.com/r/safing/comments/ryioj7/portmaster_breaks_wsl2_in_windows_11_a_guide_to/ https://www.reddit.com/r/safing/comments/ryioj7/portmaster_b... Is it fixed now?
  - dhaavi 4y ago
    We still don't have first-class support for VMs, but it will come.
    - csdvrx 4y ago
      Did you read the link? Just add a PowerShell script at install time to exempt the virtual network interfaces from Windows Firewall if WSL is detected and the user agrees! It's super simple and easy.
- slurpmaker 4y ago
  Looks like a nice project! What library are you using for a front end here?
  - dhaavi 4y ago
    Angular with TailwindCSS. Currently running in an electron instance, with the plan to switch (back) to a webview provided by the OS. UI is served by the background process, so you can also open it in the browser at 127.0.0.1:817 - if you have development mode enabled.
- maxloh 4y ago
  Hi. After a quick look, I found that the codebase spread across several repos. e.g. safing/portmaster, safing/portmaster-ui and safing/portmaster-packaging. I didn't found any guides regarding building from source. How can I build the app/installer by myself?
  - dhaavi 4y ago
    Yes, we definitely want to improve here. The thing is that Portmaster consists of a lot of components[0]. I don't think we'll get around creating a docker image that does all the steps automatically - as far as possible. For Windows this will be infeasible for most, as you need a EV Code Signing Cert (300$+) for signing the kernel extension. Can you elaborate on your use case? [0] https://docs.safing.io/portmaster/architecture/update-system#resources-explained https://docs.safing.io/portmaster/architecture/update-system...
    - maxloh 4y ago
      It is not about use cases. Since Portmaster is open-source, I expected that I can modify and compile the software by myself. Maybe I will hack around when I have time. Is compiling locally not possible without the signing cert?
      - dhaavi 4y ago
        I understand. Most repos have a "./pack" script that correctly builds all assets. You can then place them as "v0.0.0" (as _v0-0-0) in the updates directory. If you put Portmaster into dev mode (--devmode) it will load the v0.0.0 versions first. You might want to also disable automatic updates - or ignore the automatically downloaded versions. Compiling for Windows without a cert works, but the OS will refuse to load the driver. You'd need to switch to a special Windows developer mode and sign it with a local certificate. As I said, this is an area where we need to improve.
- borissk 4y ago
  Which versions of Windows do you support? Also what happens with the firewall that ships with Windows when you install Safing?
  - dhaavi 4y ago
    Q: Which versions of Windows do you support? Windows 10+11 full. Windows 7+8 without desktop notifications. Q: Also what happens with the firewall that ships with Windows when you install Safing? Currently nothing. It stays there and active as it is.
    - borissk 4y ago
      Thanks for the answers. Would you recommend to manually disable the Windows firewall?
metadat 4y ago
Are there any plans for a Mac version? Pretty cool that both Windows and Linux both are supported and already exist. Keep up the good work! I also appreciate the easy to read and clear privacy policy about what telemetry and data this SaSS platform collects and how it is handled. https://safing.io/privacy/#article-1-where-we-collect-datapii-from https://safing.io/privacy/#article-1-where-we-collect-datapi...
- CharlesW 4y ago
  For macOS I can strongly recommend Little Snitch. It's not open source, but I like that it's not subscription software and doesn't collect personal data. https://www.obdev.at/products/littlesnitch/index.html https://www.obdev.at/products/littlesnitch/index.html
  - cvwright 4y ago
    Why is “not subscription software” necessarily a good thing? Don’t you want to be the customer rather than the product?
    - metadat 4y ago
      Little Snitch still costs money, it's just a different licensing model. It's not SaSS, so only a one-time fee to purchase for the tool. The reason I'm open to paying a monthly fee for a SaSS offering is to keep getting new features and timely security updates, and support ensuring the recurring expense aspects of the service can stay alive. It's not entirely clear to me yet why PortMaster needs to be a SaSS, but it's not implausible. I don't have any Windows or Linux desktop machines in regular use currently, looking forward to trying this out once the Mac version exists.
      - CharlesW 4y ago
        > The reason I'm open to paying a monthly fee for a SaSS offering… To clarify, I'm absolutely not subscription shaming, and I understand that startups are effectively forced to use a SaaS model in order to attract investors.
devnine 4y ago
need a Mac version
deluxeroyale 4y ago
Been looking for something like this for my windows computer. Little Snitch has been invaluable over the years but never found anything that covers it’s features for windows
- alibert 4y ago
  If you are looking for a simple and light firewall (but still better than Windows Firewall), I recommend using Simplewall. It does not require a kernel extension and works with the API provided by Windows to do network filtering. https://github.com/henrypp/simplewall https://github.com/henrypp/simplewall
  - dhaavi 4y ago
    We have a blog post about this, if anyone is curious: https://safing.io/blog/2022/04/11/portmaster-vs-simplewall/ https://safing.io/blog/2022/04/11/portmaster-vs-simplewall/
    - deluxeroyale 4y ago
      Thanks this is great, it would be nice to have one to compare with LS just for the sake of features similiar too.
  - LWIRVoltage 4y ago
    Simplewall is amazing- and is impressive in how it's able to stop a lot of Microsoft's attempts to get Telemetry out. I've been looking at Portmaster for a while- it seems to be a valid option for those of us who dabble with the idea of totally halting the telemetry despite it being designed to be hard to stop
tfigment 4y ago
I've been using for about 6 months and I think its a good product. I suddenly needed a new firewall as Comodo Firewall doesn't work well with VPN I have to use (it cannot block anything). This stepped up like a champ in preventing unwanted networking behavior from Microsoft and others. The Notify Task has some times been weird but 1.0 seems to work well for me. The fact that i can point at my local DNScrypt instance is nice. I need to explore SPN more and see if it would work better than VPN for me or not.
spansoa 4y ago
I installed this about six months ago on Ubuntu 18 and it hanged when I launched. Has this been ironed out? I might try again. If I'm having issues, I'll submit an issue on Github. Was it tested on Ubuntu 18? BTW: I have to use Ubuntu 18 since version 20 is not compatible with my machine (some BS about NVIDIA drivers crashing the OS)
- dhaavi 4y ago
  We have improved a lot since then. Please try again and open an issue on GitHub if something does not work - as you said. Linux install options: https://docs.safing.io/portmaster/install/linux https://docs.safing.io/portmaster/install/linux
eckelhesten 4y ago
Is this a per device client? Is it possible to say, run it on Ubuntu as a server and have it handle the whole LAN?
- dhaavi 4y ago
  This is client software. Everything is done locally. Except of course for the SPN, which has a growing network of servers to relay traffic.
toomanyusers 4y ago
I'd really like to see more technical discussion of Safing's SPN idea and implementation (https://safing.io/spn/ https://safing.io/spn/). If I've understood it correctly, it seems to be in-line with the general trajectory of where Cloudflare is going with DNS privacy and Apple is going with its relay service. It seems obvious that VPN services should be split into Relay and Exit services so that you don't have to necessarily trust a single company not to collect and sell all your internet traffic.
- g_p 4y ago
  From a DNS privacy perspective, ODOH (Oblivious DNS over HTTPS) seems to achieve this at protocol level, with interoperability between providers. While there are tunnelled VPN (separate entry and exit), they always seem to be with the same provider. The iCloud private relay design appears to avoid this. It would be interesting to see where SPN goes, and more on how it works, as you say.
- wmf 4y ago
  It doesn't even define the acronym!
  - dhaavi 4y ago
    Sorry about that. It's "Safing Privacy Network".
- dhaavi 4y ago
  The SPN (Safing Privacy Network) aims to fill the area between VPNs and Tor. VPNs provide very little real privacy and Tor is (outside Tor Browser) very difficult to setup and configure. Yes, you are correct, there are similarities there. Except of course that SPN is open source. We do have a white paper: https://safing.io/files/whitepaper/Gate17.pdf https://safing.io/files/whitepaper/Gate17.pdf And YES! I'd love to see more technical discussion of the SPN too. So many things to unpack, to learn and improve.
nohankyou 4y ago
I remember using Postmasters (PM2E) for router serial connectivity, good times.
- NateLawson 4y ago
  Yeah, the ISP I founded in 1995 (elite.net) was a PM2ER for both dialup and routing with a Pentium 90 as the shell & web server. We quickly hit the 30 line limit and went up to the PRI-based Portmaster models. Fun and exciting times, just bringing a rural community online for the first time ever.
  - nohankyou 4y ago
    Oh yeah, the real Internet! We scaled up to an Ascend Max TNT with a DS3 before dial-up went south, ISDN stuck around quite a while though.
jonhohle 4y ago
Ooh, an article about portmaster(8)! Oh, not portmaster(8) 0 - https://www.freebsd.org/cgi/man.cgi?query=portmaster&sektion=8&manpath=FreeBSD+13.0-RELEASE+and+Ports https://www.freebsd.org/cgi/man.cgi?query=portmaster&sektion...
- deleted 4y ago
  [deleted]
- js2 4y ago
  Also not PortMaster. https://archive.org/details/h42_Livingston_Enterprises_PortMaster_25 https://archive.org/details/h42_Livingston_Enterprises_PortM...
  - Taniwha 4y ago
    Yeah that was my first thought and then: "do I still have an old portmaster around somewhere, will it run on that?" choosing the same name as a revered network router (the first one really affordable by mere mortals) may alienate some old timers
    - js2 4y ago
      While getting my CS degree, I also had a job as the SA for a small local ISP. Two Linux boxes, a PortMaster, and a dozen or so 56K Hayes modems. RADIUS authentication between the PM and the Linux boxes. Can't recall how we did accounting. I probably wrote a Perl script that scraped the RADIUS logs. The Linux distribution was probably Slackware. Kernel was probably early 2.x? Fun times... The folks I interview these days with their new fenagled CS degrees have no clue how anything works. They can write code, sure, barely, but they can't answer a single question about how _any_ of it works. How do you get a CS degree and not know the difference between TCP and UDP? How do you become a front-end developer who codes React apps but can't explain the DOM? Have no clue what a conditional GET is? It makes me sad...
- beezle 4y ago
  Lol I was just thinking the same thing. Why do I think this is going to end badly?
Tarq0n 4y ago
I've been using this for about a month and it's been excellent. Actually dropped nextDNS for it, as my main need for nextDNS was one windows desktop.
- cynod 4y ago
  Was just reading their site and wondering about that myself. But I use NextDNS on my router to cover all the devices on the house and this seems individual client based. Still, I can run it on my main machine. The networking looks a great blend of onion routing and secured connections. Really clever way of constantly changing a client IP. As someone else noted it's like a client/outgoing version of Cloudfare's DDoS mitigated network design.
- Abishek_Muthian 4y ago
  Is this like OpenSnitch + PiHole combined?
  - ignoramous 4y ago
    Pretty much, yes.
    - Abishek_Muthian 4y ago
      I guess having it combined can have portability/mobility benefits but other than that I doubt if the performance benefits of OpenSnitch (or) ability to secure entire network through PiHole is worth replacing.
      - ignoramous 4y ago
        You won't be wrong about that, but I like to think of PortMaster as more of an open-source Glasswire replacement that can also run on Linux. It is an impressive piece of software nevertheless.
mcc1ane 4y ago
What's SPN?
- xcambar 4y ago
  This. I have followed multiple links, never able to find the expansion of the acronym. So weird.
  - janka102 4y ago
    I also couldn't find it on their website, but their GitHub says it means Safing Privacy Network. https://github.com/safing/spn/ https://github.com/safing/spn/
  - dhaavi 4y ago
    Huh. Thanks, I will check that we explain that better.
- stusmall 4y ago
  Another product from them: https://safing.io/spn/ https://safing.io/spn/
- toomanyusers 4y ago
  I found a blog post (https://safing.io/blog/2022/09/06/spn-vs-vpns/ https://safing.io/blog/2022/09/06/spn-vs-vpns/), but you have to go fairly far down the page (to the header "Cryptographic Identity Protection") to begin to get the gist of what it is. "This was originally invented for Tor and is called Onion Routing. This way, every server in the chain only knows the previous and the next hop. No server ever knows who you are AND where you are going to." "As VPNs are centralized, all their servers are operated by only one entity - the VPN provider itself. They can, therefore, monitor all you traffic and see what you are up to. This is why they tout their “No Logging” policies so loudly, because they know they can see everything." "SPN on the other hand invites the community to join the network and strengthen it by adding diversity to the operators of the network. This way - in addition to the cryptographic protections - it is made almost impossible that anyone will ever be able to track you through the SPN." It sounds like it is a next-gen VPN service which addresses the shortcomings of the current VPN services by splitting the service into relays and exits, each with limited knowledge and each potentially operated by different parties.
stusmall 4y ago
I evaluated this a few months ago and absolutely loved it. It was more polished and easier to use than I expected. Since the website made a big deal about it being alpha I went in expecting a little pain. The only major problem I hit was that everytime a snap would update it would appear as a new application and I had to reapply the rules. At the time there was a proposal for a change to fix this but it hadn't been implemented yet. I think once that lands, if it hasn't already, I'll be a loyal daily user. EDIT: Adding GitHub issue link https://github.com/safing/portmaster/issues/398 https://github.com/safing/portmaster/issues/398
- dhaavi 4y ago
  We have recently added a system to support these use cases. I will see if we can add support for snap packages in the next weeks. Now tracking this internally at CC#2632.
maxcx 4y ago
Pretty interesting. Would love to see if users can choose their own servers as the underlying identity pool. PS: SPN: Safing Privacy Network, https://github.com/safing/spn https://github.com/safing/spn
- dhaavi 4y ago
  You can add your own servers to the network as community nodes. [0] For privacy, you never want to be the only person using a server. [0] https://docs.safing.io/spn/hosting-a-community-node https://docs.safing.io/spn/hosting-a-community-node
drdaeman 4y ago
Is this installed specifically on the endpoints or can it be installed on a network gateway (my edge router/gateway is a GNU/Linux machine) to provide analytics and security for the whole LAN? The website seems to be very light on any technical details, doesn't give me a slightest idea how it operates. Looking at the comments here I suspect it's a endpoint firewall using a VPN (SPN) to tunnel all the traffic through a virtualized network interface and apply rules and analytics to it.
- dhaavi 4y ago
  It is installed on the endpoint. It integrates with nfqueue on Linux and a kernel extension on Windows. It does not use a virtual interface. The SPN (Safing Privacy Network; VPN alternative) is optional. More details on the docs: https://docs.safing.io/ https://docs.safing.io/
  - tfarias 4y ago
    Any plans to support SPN installation on an edge router? I have a VPN configured in my pfSense router so that I don't need to run it in each client. I guess this would make it easy to go over the 5 device limit though... Regardless, I'll try out for the firewall and network monitoring.
    - dhaavi 4y ago
      Possibly, but more mid- to long-term. The device limit is hard, but we need to limit usage somewhere, as we don't see how much bandwidth one user uses. Can you elaborate on your use case where you have more than 5 devices?
ajolly 4y ago
What's the performance impact on this, especially on windows? Also what would happen if I installed a Windows gateway, using routing and remote access services, and then installed portmaster on that? Overall this looks pretty awesome, and I'm excited to try it out. Oh and can I use this in conjunction with wire guard? How does it play with other vpns.
- dhaavi 4y ago
  Q: What's the performance impact on this, especially on windows? Basically negligible. Secure DNS might be a bit slower and you might feel some impact on low end devices. Q: Also what would happen if I installed a Windows gateway, using routing and remote access services, and then installed portmaster on that? You'd probably be cut off as incoming connections are blocked by default. Please place a config with exceptions before install or have (virtual) physical access when installing. Q: Oh and can I use this in conjunction with wire guard? How does it play with other vpns. We have a whole page on that in the docs: https://docs.safing.io/portmaster/install/status/vpn-compatibility https://docs.safing.io/portmaster/install/status/vpn-compati...
  - ajolly 4y ago
    First of all, thanks for this, I've been using it today. I'll e-mail later with a longer list of comments/suggestions. First request would be a way to sync settings across multiple machines, or at least a way to import/export configs. I did get hit with the issue about having incoming connections blocked by default - realized RDP connections were blocked even from the local subnet, and had to go plug a physical monitor in. I was a bit surprised I couldn't figure out a clean way to allow inbound connections from the local network, but not from the internet. The docs at https://docs.safing.io/portmaster/settings https://docs.safing.io/portmaster/settings seem to imply that I can set various settings to different tiers - 7 for trusted, for untrusted, 4 for hacked, but even when I have the developer view tuned on, I just see a binary choice.
    - dhaavi 4y ago
      > imply that I can set various settings to different tiers - 7 for trusted, for untrusted, 4 for hacked Check out this page on the docs: https://docs.safing.io/portmaster/guides/network-rating https://docs.safing.io/portmaster/guides/network-rating > sync settings across multiple machines planned, but long-term goal. > import/export configs planned, short-term goal.
yewenjie 4y ago
Still can't use it on NixOS :(
DavideNL 4y ago
> Please note that pretty much all the DNS leak detection tests by the VPN providers will be a false positive, as the only thing they check is if you are using their DNS servers. Rest assured that your DNS queries are well protected by the Portmaster and there is no need to be concerned." [1] That's a confusing statement... does this mean they change your DNS server/provider by default, if you are using a VPN? [1] https://docs.safing.io/portmaster/install/status/vpn-compatibility https://docs.safing.io/portmaster/install/status/vpn-compati...
- byteshock 4y ago
  I think it’s because SPN uses a different IP/node per connection you make. DNS leak detection tests will ask your browser to resolve unique subdomains. If the DNS server that requests the lookup is different from your connecting IP to the website, they will say you have a DNS leak. https://security.stackexchange.com/questions/42752/how-does-dnsleaktest-com-find-my-dns-provider https://security.stackexchange.com/questions/42752/how-does-...
  - dhaavi 4y ago
    That would be true if would be resolving all DNS yourself. Nowadays everyone uses a recursive resolver. See my other answer for details about this case.
- dhaavi 4y ago
  Pretty much all VPNs use their own DNS servers. Their "DNS Leak Tests" just check if queries come from that DNS server. Portmaster overrides any custom DNS server and enforces the ones the user set - or are set by default. This "breaks" the VPN leak test. You'd need to use a leak test from the DNS provider for it to work. Thanks for the feedback. I will look into improving the text.
  - DavideNL 4y ago
    > "overrides any custom DNS server and enforces the ones the user set - or are set by default" If Portmaster "enforces DNS servers with the ones that are set", after installing Portmaster and without the user changing anything, i'd say that's a decrease of privacy; Your VPN provider can see your traffic in any case (even when you're not using their DNS server.) So, if Portmaster would change this to whatever your default is (Cloudflare, Google, etc.), people are then suddenly sharing their DNS requests with yet another 3th party.
jeroenhd 4y ago
Definitely one of the best firewalls for normal people on Linux. (g)UFW is nice and easy but very basic. Portmaster is a lot closer to the firewalls you may find for Windows that list applications and their statistics/configuration. My only problem with it is that under heavy load the DoH server dies or gets stuck at 50% CPU for me. It also hangs my custom DoT/DoH solution for some reason but that's not a Portmaster problem.
- dhaavi 4y ago
  Thanks! That's exactly what we are aiming for! About your DNS issues: Have you opened an issue on GitHub yet?
  - jeroenhd 4y ago
    I haven't had time to debug this issue yet, it mostly occurs when I'm busy with more important stuff so I usually just restart the service one or twice to get the process to behave. I'll try to remember to collect the logs next time it happens so I can open a useful issue.
    - dhaavi 4y ago
      Great! While it happens, simply go to the "Get Help" page in Portmaster and click on "Report Bug". It will collect some debug info and you can create an issue directly on GitHub from there.
byteshock 4y ago
I remember trying out Portmaster on Windows earlier this year. I think Portmaster was running a local DNS server to see what connections were being made. This interfered with my VPN, Mullvad, which was trying to use a remote DNS server. Does Portmaster still require a local DNS server? I’ve been an avid user of Glasswire for years and it works flawlessly with my VPN. But i would love to switch to a open source alternative.
- dhaavi 4y ago
  Portmaster still (and probably always will) require a local DNS server. Why? Because there is not always and will be less ways in the future to find out which Domain an IP address belongs to. GlassWire will probably become quite blind as soon as TLS1.3 is rolled out and working as intended. I will look into Mullvad compatibility again in the coming weeks. I think they also improved some stuff on their side. User from 2 weeks ago: "Can confirm that Portmaster V.1.0.0 with Mullvard V2022.4 DNS set to 127.0.0.1 and the same setting on the netwerk controller both can life together." from https://github.com/safing/portmaster/issues/313 https://github.com/safing/portmaster/issues/313
  - byteshock 4y ago
    Awesome, thank you for the reply. Will try out Portmaster again!
agilob 4y ago
Yghm... can I run it on kubernetes?
- dhaavi 4y ago
  It's a software for clients / desktops.
  - agilob 4y ago
    Can't be run network wide on kubernetes or router? Then it's not a competitor to pihole?
    - dhaavi 4y ago
      Well, that depends on the use case. You might call it an indirect competitor.
    - senden9 4y ago
      Right. Other use case. PiHole is setup for network normally. This solution is personal desktop firewall. So it has more access to information, but is also easier breakable (like break thru) for "bad" software on your PC.
Matl 4y ago
Is there a way to use this as 'just a firewall'? Not touching my DNS config or preventing VPNs from setting their own etc.?
- pyinstallwoes 4y ago
  Yea I’ve done that.
- dhaavi 4y ago
  You can disable the Seamless DNS Integration[0], and configure DNS manually [1]. DNS queries will still have to go through Portmaster. It does regular self-checks and will nag you until you fix it. [0] https://docs.safing.io/portmaster/settings#filter/dnsQueryInterception https://docs.safing.io/portmaster/settings#filter/dnsQueryIn... [1] https://docs.safing.io/portmaster/guides/dns-configuration https://docs.safing.io/portmaster/guides/dns-configuration
ike0790 4y ago
This is awesome. Definitely gonna check it out...
deleted 4y ago
[deleted]
Terretta 4y ago
Livingston Portmaster 3 PM3A-1E is a RAS (Remote Access Server) that: - terminates one 1E line (30 B-channels) - provides ISDN dial-up on those channels - provides DSP based modems in case analog modem calls should be handled This was a key component of being an ISP in early days. https://osmocom.org/projects/retronetworking/wiki/Livingston_Portmaster_3 https://osmocom.org/projects/retronetworking/wiki/Livingston...
- deleted 4y ago
  [deleted]
- mlyle 4y ago
  I just bought an AS5300 to play with a few months ago to see if I could get 56k modem connections to work over VOIP. SIP channels -> voice card -> out a T1 (network) -> in another T1 (CPE) -> to DSP modem. (Or dialout, DSP modem -> out a T1 (CPE) -> in a T1 (network) -> voice card -> SIP. It just -doesn't quite- work. I can get 14400 no problem, but V.90 doesn't seem to entrain. Still troubleshooting (could be undesirable jitter buffer settings on my ISP side). I just barely missed end-of-sales of ISDN BRI in my area which could have been useful for get to the PSTN at high quality.
yumswiss 4y ago
I’ve been using this for couple months now on linux. Impressive piece of software. No issues so far.
dns_snek 4y ago
Neat product! I have a couple of questions, mainly surrounding the SPN. * How does SPN differ from a VPN, in detail? In other comments you said that it's similar to Tor, but what does that actually mean? * Does traffic get routed through multiple nodes before being routed to the destination? If not, what sets it apart from a VPN - apart from being able to choose different servers for every program on your PC? * Is SPN intended to provide privacy against nation-state actors where simply masking your exit node is not sufficient, similar to what Tor claims to do? * Who operates exit nodes (and any intermediary nodes in the SPN network), are they owned or rented dedicated servers, and does it include residential connections - to provide unblocking for streaming services? * Is traffic routed through other Portmaster users' internet connections?
- dhaavi 4y ago
  Q: How does SPN differ from a VPN, in detail? In other comments you said that it's similar to Tor, but what does that actually mean? If you haven't read these post [0][1] already, please do so and come back with any remaining questions! [0] https://safing.io/blog/2022/09/06/spn-vs-vpns/ https://safing.io/blog/2022/09/06/spn-vs-vpns/ [1] https://safing.io/blog/2020/01/22/how-the-spn-compares-to-tor/ https://safing.io/blog/2020/01/22/how-the-spn-compares-to-to... Q: Does traffic get routed through multiple nodes before being routed to the destination? If not, what sets it apart from a VPN - apart from being able to choose different servers for every program on your PC? Yes. And you can configure how much of that you want - per App: https://docs.safing.io/portmaster/settings#spn/routingAlgorithm https://docs.safing.io/portmaster/settings#spn/routingAlgori... Q: Is SPN intended to provide privacy against nation-state actors where simply masking your exit node is not sufficient, similar to what Tor claims to do? "Nation-state actor" is a bit vague, assuming the most common meaning (IMO): a global passive adversary. Quoting from the Tor design document: A global passive adversary is the most commonly assumed threat when analyzing theoretical anonymity designs. But like all practical low-latency systems, Tor does not protect against such a strong adversary. Neither Tor, or the SPN (or anything else) will protect you from this. If they can really see everything, they will find you - sooner or later. What we aim for is to stop exposing you to the data sources of the mass surveillance dragnet: Online tracking and the Internet-network itself. Q: Who operates exit nodes (and any intermediary nodes in the SPN network), are they owned or rented dedicated servers, and does it include residential connections - to provide unblocking for streaming services? Currently we rent servers, but will start adding our own dedicated ones once the scale is there. Nodes are also hosted by the community to diversify the node ownership in order to strengthen the privacy protection. Currently not using residential connections. Q: Is traffic routed through other Portmaster users' internet connections? No.

311 points by dhaavi 4y ago

CTO and Co-Founder of Safing here. We're super excited to introduce version 1.0 of our network monitor and privacy firewall - Portmaster! On 1.1. this year, Portmaster was shared on HN and we hit front page [1]. With the help of our testers - many of you! - we were able to mature and develop Portmaster to hit this milestone. We're on a mission to bring privacy back to the masses. Privacy has to be easy & accessible for everyone, while hackers and tinkerers should have the tools to customize everything to their needs. So while Portmaster 1.0 is a big milestone, this is just the start! [1]: https://news.ycombinator.com/item?id=29761978 https://news.ycombinator.com/item?id=29761978 [2]: https://star-history.com/#safing/portmaster&Date https://star-history.com/#safing/portmaster&Date

OrvalWintermute 4y ago
Looks intriguing. A few questions: (1) Are you planning on having support for more than 5 devices at a future point? (2) Will you have any features to support parents protection of their children? (3) How easy is it to integrate Safing into a home security stack, or an enterprise security stack? (4) Have you considered a one-time unlimited buy-in level in lieu of monthly? (5) Is this coming for iOS & MacOS? Thanks for pushing the privacy front.
- dhaavi 4y ago
  Thanks for your interest. (1) Are you planning on having support for more than 5 devices at a future point? 5 devices is what we estimate 1 user has (avg max). If there is demand, we will definitely add a plan to support more devices (or users). (2) Will you have any features to support parents protection of their children? We already collect NSFW filter lists to be activated in the settings. Otherwise such features are tricky, as we need to start protecting against the person in front of the device, which is very hard. If you have suggestions, please share! (3) How easy is it to integrate Safing into a home security stack, or an enterprise security stack? Can you elaborate on what exactly you have in mind? We don't offer any integrations with other system out of the box yet. We have APIs though that you can use. (4) Have you considered a one-time unlimited buy-in level in lieu of monthly? We had a couple lifetime plans on our Kickstarter (years ago). Right now, we don't have any plans for this. You can pay in advance though - up to 4 years. (5) Is this coming for iOS & MacOS? Yes. Or, at least we will attempt. Going to be "fun" if Apple continues their locking down strategy. Maybe the EU will force them to open up until then. Expect at least 1-2 years for this to land though.
  - mdip 4y ago
    Rather insightful on (2) with regard to: > ... we need to start protecting against the person in front of the device My first thought was, "Oh, God, please don't". I'm a parent, if I put that software on the computer it comes with rules not to touch it; if it's touched, they know I'll probably find out, ban them from it for a bit and return it to them locked down in a manner that when I return it to its original state, they won't touch it again. :o). But then I thought of the other common reason this kind of capability is added to software -- are you preparing for the eventual future where you will have to do this, not to protect from a child removing the software, but to protect from another app surreptitiously removing Portmaster in order to bypass its protections?
    - dhaavi 4y ago
      Yes. Good points. Well, the first thing we might do is just a "Only an Administrator can make changes." setting where you only admin accounts are allowed to change settings. This one makes sense. Everything beyond that gets complicated and easy to circumvent fast. (I also think the original question was more about blocking features and the likes.) Protecting against other software is related, but also different. We have some decent protection here, albeit not against simply shutting Portmaster down.
  - OrvalWintermute 4y ago
    >(1) Are you planning on having support for more than 5 devices at a future point? >5 devices is what we estimate 1 user has (avg max). If there is demand, we will definitely add a plan to support more devices (or users). I'd estimate for a family plan (my case) we'd have 5 users. Given that I am on HN and part of the technocrati collective we have a ton of devices, particularly once your iOS & Mac OS coverage kicks in too. >(2) Will you have any features to support parents protection of their children? >We already collect NSFW filter lists to be activated in the settings. Otherwise such features are tricky, as we need to start protecting against the person in front of the device, which is very hard. If you have suggestions, please share! I think it would be person in front of the device, but a NSFW filter list is the min requirement, sounds like you already meet that. >(3) How easy is it to integrate Safing into a home security stack, or an enterprise security stack? >Can you elaborate on what exactly you have in mind? We don't offer any integrations with other system out of the box yet. We have APIs though that you can use. Aggregating logs across all devices protected. I don't know if syslog would be best, as there are options Unified console for centralized control of all instances would be a stretch goal
runlevel1 4y ago
Congrats on releasing 1.0! It looks very cool. A few questions about Portmaster Unlimited and SPN: 1. Does Safing own and operate all the exit nodes or can folks add their own nodes to it? 2. Are you self-hosting the exit nodes? If not, I'm curious what cloud providers you use. 3. Have you found egressing through a bunch of different geolocated IPs for the same request triggers DDoS/anti-scraping systems (like Cloudflare) more than usual?
- dhaavi 4y ago
  Thanks! 1. Does Safing own and operate all the exit nodes or can folks add their own nodes to it? Everyone can join. We also plan to compensate in some way in the future. Docs: https://docs.safing.io/spn/hosting-a-community-node https://docs.safing.io/spn/hosting-a-community-node 2. Are you self-hosting the exit nodes? If not, I'm curious what cloud providers you use. We rent servers. If you have the SPN, you can click on every server on the map and check where it is hosted. Currently mainly Hetzner, OVH, Katamera, HostHatch. We regularly try new providers, rent a couple servers and see how it goes. 3. Have you found egressing through a bunch of different geolocated IPs for the same request triggers DDoS/anti-scraping systems (like Cloudflare) more than usual? The client "pins" destination domains/IPs to an exit for an hour (scoped per app) in order to get more stability here. We had issues in the past.
csdvrx 4y ago
Congrats! Just one question: In the past, postmaster had problems with WSL2. I documented the issue and the solution: https://www.reddit.com/r/safing/comments/ryioj7/portmaster_breaks_wsl2_in_windows_11_a_guide_to/ https://www.reddit.com/r/safing/comments/ryioj7/portmaster_b... Is it fixed now?
- dhaavi 4y ago
  We still don't have first-class support for VMs, but it will come.
  - csdvrx 4y ago
    Did you read the link? Just add a PowerShell script at install time to exempt the virtual network interfaces from Windows Firewall if WSL is detected and the user agrees! It's super simple and easy.
slurpmaker 4y ago
Looks like a nice project! What library are you using for a front end here?
- dhaavi 4y ago
  Angular with TailwindCSS. Currently running in an electron instance, with the plan to switch (back) to a webview provided by the OS. UI is served by the background process, so you can also open it in the browser at 127.0.0.1:817 - if you have development mode enabled.
maxloh 4y ago
Hi. After a quick look, I found that the codebase spread across several repos. e.g. safing/portmaster, safing/portmaster-ui and safing/portmaster-packaging. I didn't found any guides regarding building from source. How can I build the app/installer by myself?
- dhaavi 4y ago
  Yes, we definitely want to improve here. The thing is that Portmaster consists of a lot of components[0]. I don't think we'll get around creating a docker image that does all the steps automatically - as far as possible. For Windows this will be infeasible for most, as you need a EV Code Signing Cert (300$+) for signing the kernel extension. Can you elaborate on your use case? [0] https://docs.safing.io/portmaster/architecture/update-system#resources-explained https://docs.safing.io/portmaster/architecture/update-system...
  - maxloh 4y ago
    It is not about use cases. Since Portmaster is open-source, I expected that I can modify and compile the software by myself. Maybe I will hack around when I have time. Is compiling locally not possible without the signing cert?
    - dhaavi 4y ago
      I understand. Most repos have a "./pack" script that correctly builds all assets. You can then place them as "v0.0.0" (as _v0-0-0) in the updates directory. If you put Portmaster into dev mode (--devmode) it will load the v0.0.0 versions first. You might want to also disable automatic updates - or ignore the automatically downloaded versions. Compiling for Windows without a cert works, but the OS will refuse to load the driver. You'd need to switch to a special Windows developer mode and sign it with a local certificate. As I said, this is an area where we need to improve.
borissk 4y ago
Which versions of Windows do you support? Also what happens with the firewall that ships with Windows when you install Safing?
- dhaavi 4y ago
  Q: Which versions of Windows do you support? Windows 10+11 full. Windows 7+8 without desktop notifications. Q: Also what happens with the firewall that ships with Windows when you install Safing? Currently nothing. It stays there and active as it is.
  - borissk 4y ago
    Thanks for the answers. Would you recommend to manually disable the Windows firewall?

metadat 4y ago

Are there any plans for a Mac version? Pretty cool that both Windows and Linux both are supported and already exist. Keep up the good work! I also appreciate the easy to read and clear privacy policy about what telemetry and data this SaSS platform collects and how it is handled. https://safing.io/privacy/#article-1-where-we-collect-datapii-from https://safing.io/privacy/#article-1-where-we-collect-datapi...

CharlesW 4y ago
For macOS I can strongly recommend Little Snitch. It's not open source, but I like that it's not subscription software and doesn't collect personal data. https://www.obdev.at/products/littlesnitch/index.html https://www.obdev.at/products/littlesnitch/index.html
- cvwright 4y ago
  Why is “not subscription software” necessarily a good thing? Don’t you want to be the customer rather than the product?
  - metadat 4y ago
    Little Snitch still costs money, it's just a different licensing model. It's not SaSS, so only a one-time fee to purchase for the tool. The reason I'm open to paying a monthly fee for a SaSS offering is to keep getting new features and timely security updates, and support ensuring the recurring expense aspects of the service can stay alive. It's not entirely clear to me yet why PortMaster needs to be a SaSS, but it's not implausible. I don't have any Windows or Linux desktop machines in regular use currently, looking forward to trying this out once the Mac version exists.
    - CharlesW 4y ago
      > The reason I'm open to paying a monthly fee for a SaSS offering… To clarify, I'm absolutely not subscription shaming, and I understand that startups are effectively forced to use a SaaS model in order to attract investors.

devnine 4y ago

need a Mac version

deluxeroyale 4y ago

Been looking for something like this for my windows computer. Little Snitch has been invaluable over the years but never found anything that covers it’s features for windows

alibert 4y ago
If you are looking for a simple and light firewall (but still better than Windows Firewall), I recommend using Simplewall. It does not require a kernel extension and works with the API provided by Windows to do network filtering. https://github.com/henrypp/simplewall https://github.com/henrypp/simplewall
- dhaavi 4y ago
  We have a blog post about this, if anyone is curious: https://safing.io/blog/2022/04/11/portmaster-vs-simplewall/ https://safing.io/blog/2022/04/11/portmaster-vs-simplewall/
  - deluxeroyale 4y ago
    Thanks this is great, it would be nice to have one to compare with LS just for the sake of features similiar too.
- LWIRVoltage 4y ago
  Simplewall is amazing- and is impressive in how it's able to stop a lot of Microsoft's attempts to get Telemetry out. I've been looking at Portmaster for a while- it seems to be a valid option for those of us who dabble with the idea of totally halting the telemetry despite it being designed to be hard to stop

tfigment 4y ago

I've been using for about 6 months and I think its a good product. I suddenly needed a new firewall as Comodo Firewall doesn't work well with VPN I have to use (it cannot block anything). This stepped up like a champ in preventing unwanted networking behavior from Microsoft and others. The Notify Task has some times been weird but 1.0 seems to work well for me. The fact that i can point at my local DNScrypt instance is nice. I need to explore SPN more and see if it would work better than VPN for me or not.

spansoa 4y ago

I installed this about six months ago on Ubuntu 18 and it hanged when I launched. Has this been ironed out? I might try again. If I'm having issues, I'll submit an issue on Github. Was it tested on Ubuntu 18? BTW: I have to use Ubuntu 18 since version 20 is not compatible with my machine (some BS about NVIDIA drivers crashing the OS)

dhaavi 4y ago
We have improved a lot since then. Please try again and open an issue on GitHub if something does not work - as you said. Linux install options: https://docs.safing.io/portmaster/install/linux https://docs.safing.io/portmaster/install/linux

eckelhesten 4y ago

Is this a per device client? Is it possible to say, run it on Ubuntu as a server and have it handle the whole LAN?

dhaavi 4y ago
This is client software. Everything is done locally. Except of course for the SPN, which has a growing network of servers to relay traffic.

toomanyusers 4y ago

I'd really like to see more technical discussion of Safing's SPN idea and implementation (https://safing.io/spn/ https://safing.io/spn/). If I've understood it correctly, it seems to be in-line with the general trajectory of where Cloudflare is going with DNS privacy and Apple is going with its relay service. It seems obvious that VPN services should be split into Relay and Exit services so that you don't have to necessarily trust a single company not to collect and sell all your internet traffic.

g_p 4y ago
From a DNS privacy perspective, ODOH (Oblivious DNS over HTTPS) seems to achieve this at protocol level, with interoperability between providers. While there are tunnelled VPN (separate entry and exit), they always seem to be with the same provider. The iCloud private relay design appears to avoid this. It would be interesting to see where SPN goes, and more on how it works, as you say.
wmf 4y ago
It doesn't even define the acronym!
- dhaavi 4y ago
  Sorry about that. It's "Safing Privacy Network".
dhaavi 4y ago
The SPN (Safing Privacy Network) aims to fill the area between VPNs and Tor. VPNs provide very little real privacy and Tor is (outside Tor Browser) very difficult to setup and configure. Yes, you are correct, there are similarities there. Except of course that SPN is open source. We do have a white paper: https://safing.io/files/whitepaper/Gate17.pdf https://safing.io/files/whitepaper/Gate17.pdf And YES! I'd love to see more technical discussion of the SPN too. So many things to unpack, to learn and improve.

nohankyou 4y ago

I remember using Postmasters (PM2E) for router serial connectivity, good times.

NateLawson 4y ago
Yeah, the ISP I founded in 1995 (elite.net) was a PM2ER for both dialup and routing with a Pentium 90 as the shell & web server. We quickly hit the 30 line limit and went up to the PRI-based Portmaster models. Fun and exciting times, just bringing a rural community online for the first time ever.
- nohankyou 4y ago
  Oh yeah, the real Internet! We scaled up to an Ascend Max TNT with a DS3 before dial-up went south, ISDN stuck around quite a while though.

jonhohle 4y ago

Ooh, an article about portmaster(8)! Oh, not portmaster(8) 0 - https://www.freebsd.org/cgi/man.cgi?query=portmaster&sektion=8&manpath=FreeBSD+13.0-RELEASE+and+Ports https://www.freebsd.org/cgi/man.cgi?query=portmaster&sektion...

deleted 4y ago
[deleted]
js2 4y ago
Also not PortMaster. https://archive.org/details/h42_Livingston_Enterprises_PortMaster_25 https://archive.org/details/h42_Livingston_Enterprises_PortM...
- Taniwha 4y ago
  Yeah that was my first thought and then: "do I still have an old portmaster around somewhere, will it run on that?" choosing the same name as a revered network router (the first one really affordable by mere mortals) may alienate some old timers
  - js2 4y ago
    While getting my CS degree, I also had a job as the SA for a small local ISP. Two Linux boxes, a PortMaster, and a dozen or so 56K Hayes modems. RADIUS authentication between the PM and the Linux boxes. Can't recall how we did accounting. I probably wrote a Perl script that scraped the RADIUS logs. The Linux distribution was probably Slackware. Kernel was probably early 2.x? Fun times... The folks I interview these days with their new fenagled CS degrees have no clue how anything works. They can write code, sure, barely, but they can't answer a single question about how _any_ of it works. How do you get a CS degree and not know the difference between TCP and UDP? How do you become a front-end developer who codes React apps but can't explain the DOM? Have no clue what a conditional GET is? It makes me sad...
beezle 4y ago
Lol I was just thinking the same thing. Why do I think this is going to end badly?

Tarq0n 4y ago

I've been using this for about a month and it's been excellent. Actually dropped nextDNS for it, as my main need for nextDNS was one windows desktop.

cynod 4y ago
Was just reading their site and wondering about that myself. But I use NextDNS on my router to cover all the devices on the house and this seems individual client based. Still, I can run it on my main machine. The networking looks a great blend of onion routing and secured connections. Really clever way of constantly changing a client IP. As someone else noted it's like a client/outgoing version of Cloudfare's DDoS mitigated network design.
Abishek_Muthian 4y ago
Is this like OpenSnitch + PiHole combined?
- ignoramous 4y ago
  Pretty much, yes.
  - Abishek_Muthian 4y ago
    I guess having it combined can have portability/mobility benefits but other than that I doubt if the performance benefits of OpenSnitch (or) ability to secure entire network through PiHole is worth replacing.
    - ignoramous 4y ago
      You won't be wrong about that, but I like to think of PortMaster as more of an open-source Glasswire replacement that can also run on Linux. It is an impressive piece of software nevertheless.

mcc1ane 4y ago

What's SPN?

xcambar 4y ago
This. I have followed multiple links, never able to find the expansion of the acronym. So weird.
- janka102 4y ago
  I also couldn't find it on their website, but their GitHub says it means Safing Privacy Network. https://github.com/safing/spn/ https://github.com/safing/spn/
- dhaavi 4y ago
  Huh. Thanks, I will check that we explain that better.
stusmall 4y ago
Another product from them: https://safing.io/spn/ https://safing.io/spn/
toomanyusers 4y ago
I found a blog post (https://safing.io/blog/2022/09/06/spn-vs-vpns/ https://safing.io/blog/2022/09/06/spn-vs-vpns/), but you have to go fairly far down the page (to the header "Cryptographic Identity Protection") to begin to get the gist of what it is. "This was originally invented for Tor and is called Onion Routing. This way, every server in the chain only knows the previous and the next hop. No server ever knows who you are AND where you are going to." "As VPNs are centralized, all their servers are operated by only one entity - the VPN provider itself. They can, therefore, monitor all you traffic and see what you are up to. This is why they tout their “No Logging” policies so loudly, because they know they can see everything." "SPN on the other hand invites the community to join the network and strengthen it by adding diversity to the operators of the network. This way - in addition to the cryptographic protections - it is made almost impossible that anyone will ever be able to track you through the SPN." It sounds like it is a next-gen VPN service which addresses the shortcomings of the current VPN services by splitting the service into relays and exits, each with limited knowledge and each potentially operated by different parties.

stusmall 4y ago

I evaluated this a few months ago and absolutely loved it. It was more polished and easier to use than I expected. Since the website made a big deal about it being alpha I went in expecting a little pain. The only major problem I hit was that everytime a snap would update it would appear as a new application and I had to reapply the rules. At the time there was a proposal for a change to fix this but it hadn't been implemented yet. I think once that lands, if it hasn't already, I'll be a loyal daily user. EDIT: Adding GitHub issue link https://github.com/safing/portmaster/issues/398 https://github.com/safing/portmaster/issues/398

dhaavi 4y ago
We have recently added a system to support these use cases. I will see if we can add support for snap packages in the next weeks. Now tracking this internally at CC#2632.

maxcx 4y ago

Pretty interesting. Would love to see if users can choose their own servers as the underlying identity pool. PS: SPN: Safing Privacy Network, https://github.com/safing/spn https://github.com/safing/spn

dhaavi 4y ago
You can add your own servers to the network as community nodes. [0] For privacy, you never want to be the only person using a server. [0] https://docs.safing.io/spn/hosting-a-community-node https://docs.safing.io/spn/hosting-a-community-node

drdaeman 4y ago

Is this installed specifically on the endpoints or can it be installed on a network gateway (my edge router/gateway is a GNU/Linux machine) to provide analytics and security for the whole LAN? The website seems to be very light on any technical details, doesn't give me a slightest idea how it operates. Looking at the comments here I suspect it's a endpoint firewall using a VPN (SPN) to tunnel all the traffic through a virtualized network interface and apply rules and analytics to it.

dhaavi 4y ago
It is installed on the endpoint. It integrates with nfqueue on Linux and a kernel extension on Windows. It does not use a virtual interface. The SPN (Safing Privacy Network; VPN alternative) is optional. More details on the docs: https://docs.safing.io/ https://docs.safing.io/
- tfarias 4y ago
  Any plans to support SPN installation on an edge router? I have a VPN configured in my pfSense router so that I don't need to run it in each client. I guess this would make it easy to go over the 5 device limit though... Regardless, I'll try out for the firewall and network monitoring.
  - dhaavi 4y ago
    Possibly, but more mid- to long-term. The device limit is hard, but we need to limit usage somewhere, as we don't see how much bandwidth one user uses. Can you elaborate on your use case where you have more than 5 devices?

ajolly 4y ago

What's the performance impact on this, especially on windows? Also what would happen if I installed a Windows gateway, using routing and remote access services, and then installed portmaster on that? Overall this looks pretty awesome, and I'm excited to try it out. Oh and can I use this in conjunction with wire guard? How does it play with other vpns.

dhaavi 4y ago
Q: What's the performance impact on this, especially on windows? Basically negligible. Secure DNS might be a bit slower and you might feel some impact on low end devices. Q: Also what would happen if I installed a Windows gateway, using routing and remote access services, and then installed portmaster on that? You'd probably be cut off as incoming connections are blocked by default. Please place a config with exceptions before install or have (virtual) physical access when installing. Q: Oh and can I use this in conjunction with wire guard? How does it play with other vpns. We have a whole page on that in the docs: https://docs.safing.io/portmaster/install/status/vpn-compatibility https://docs.safing.io/portmaster/install/status/vpn-compati...
- ajolly 4y ago
  First of all, thanks for this, I've been using it today. I'll e-mail later with a longer list of comments/suggestions. First request would be a way to sync settings across multiple machines, or at least a way to import/export configs. I did get hit with the issue about having incoming connections blocked by default - realized RDP connections were blocked even from the local subnet, and had to go plug a physical monitor in. I was a bit surprised I couldn't figure out a clean way to allow inbound connections from the local network, but not from the internet. The docs at https://docs.safing.io/portmaster/settings https://docs.safing.io/portmaster/settings seem to imply that I can set various settings to different tiers - 7 for trusted, for untrusted, 4 for hacked, but even when I have the developer view tuned on, I just see a binary choice.
  - dhaavi 4y ago
    > imply that I can set various settings to different tiers - 7 for trusted, for untrusted, 4 for hacked Check out this page on the docs: https://docs.safing.io/portmaster/guides/network-rating https://docs.safing.io/portmaster/guides/network-rating > sync settings across multiple machines planned, but long-term goal. > import/export configs planned, short-term goal.

yewenjie 4y ago

Still can't use it on NixOS :(

DavideNL 4y ago

> Please note that pretty much all the DNS leak detection tests by the VPN providers will be a false positive, as the only thing they check is if you are using their DNS servers. Rest assured that your DNS queries are well protected by the Portmaster and there is no need to be concerned." [1] That's a confusing statement... does this mean they change your DNS server/provider by default, if you are using a VPN? [1] https://docs.safing.io/portmaster/install/status/vpn-compatibility https://docs.safing.io/portmaster/install/status/vpn-compati...

byteshock 4y ago
I think it’s because SPN uses a different IP/node per connection you make. DNS leak detection tests will ask your browser to resolve unique subdomains. If the DNS server that requests the lookup is different from your connecting IP to the website, they will say you have a DNS leak. https://security.stackexchange.com/questions/42752/how-does-dnsleaktest-com-find-my-dns-provider https://security.stackexchange.com/questions/42752/how-does-...
- dhaavi 4y ago
  That would be true if would be resolving all DNS yourself. Nowadays everyone uses a recursive resolver. See my other answer for details about this case.
dhaavi 4y ago
Pretty much all VPNs use their own DNS servers. Their "DNS Leak Tests" just check if queries come from that DNS server. Portmaster overrides any custom DNS server and enforces the ones the user set - or are set by default. This "breaks" the VPN leak test. You'd need to use a leak test from the DNS provider for it to work. Thanks for the feedback. I will look into improving the text.
- DavideNL 4y ago
  > "overrides any custom DNS server and enforces the ones the user set - or are set by default" If Portmaster "enforces DNS servers with the ones that are set", after installing Portmaster and without the user changing anything, i'd say that's a decrease of privacy; Your VPN provider can see your traffic in any case (even when you're not using their DNS server.) So, if Portmaster would change this to whatever your default is (Cloudflare, Google, etc.), people are then suddenly sharing their DNS requests with yet another 3th party.

jeroenhd 4y ago

Definitely one of the best firewalls for normal people on Linux. (g)UFW is nice and easy but very basic. Portmaster is a lot closer to the firewalls you may find for Windows that list applications and their statistics/configuration. My only problem with it is that under heavy load the DoH server dies or gets stuck at 50% CPU for me. It also hangs my custom DoT/DoH solution for some reason but that's not a Portmaster problem.

dhaavi 4y ago
Thanks! That's exactly what we are aiming for! About your DNS issues: Have you opened an issue on GitHub yet?
- jeroenhd 4y ago
  I haven't had time to debug this issue yet, it mostly occurs when I'm busy with more important stuff so I usually just restart the service one or twice to get the process to behave. I'll try to remember to collect the logs next time it happens so I can open a useful issue.
  - dhaavi 4y ago
    Great! While it happens, simply go to the "Get Help" page in Portmaster and click on "Report Bug". It will collect some debug info and you can create an issue directly on GitHub from there.

byteshock 4y ago

I remember trying out Portmaster on Windows earlier this year. I think Portmaster was running a local DNS server to see what connections were being made. This interfered with my VPN, Mullvad, which was trying to use a remote DNS server. Does Portmaster still require a local DNS server? I’ve been an avid user of Glasswire for years and it works flawlessly with my VPN. But i would love to switch to a open source alternative.

dhaavi 4y ago
Portmaster still (and probably always will) require a local DNS server. Why? Because there is not always and will be less ways in the future to find out which Domain an IP address belongs to. GlassWire will probably become quite blind as soon as TLS1.3 is rolled out and working as intended. I will look into Mullvad compatibility again in the coming weeks. I think they also improved some stuff on their side. User from 2 weeks ago: "Can confirm that Portmaster V.1.0.0 with Mullvard V2022.4 DNS set to 127.0.0.1 and the same setting on the netwerk controller both can life together." from https://github.com/safing/portmaster/issues/313 https://github.com/safing/portmaster/issues/313
- byteshock 4y ago
  Awesome, thank you for the reply. Will try out Portmaster again!

agilob 4y ago

Yghm... can I run it on kubernetes?

dhaavi 4y ago
It's a software for clients / desktops.
- agilob 4y ago
  Can't be run network wide on kubernetes or router? Then it's not a competitor to pihole?
  - dhaavi 4y ago
    Well, that depends on the use case. You might call it an indirect competitor.
  - senden9 4y ago
    Right. Other use case. PiHole is setup for network normally. This solution is personal desktop firewall. So it has more access to information, but is also easier breakable (like break thru) for "bad" software on your PC.

Matl 4y ago

Is there a way to use this as 'just a firewall'? Not touching my DNS config or preventing VPNs from setting their own etc.?

pyinstallwoes 4y ago
Yea I’ve done that.
dhaavi 4y ago
You can disable the Seamless DNS Integration[0], and configure DNS manually [1]. DNS queries will still have to go through Portmaster. It does regular self-checks and will nag you until you fix it. [0] https://docs.safing.io/portmaster/settings#filter/dnsQueryInterception https://docs.safing.io/portmaster/settings#filter/dnsQueryIn... [1] https://docs.safing.io/portmaster/guides/dns-configuration https://docs.safing.io/portmaster/guides/dns-configuration

ike0790 4y ago

This is awesome. Definitely gonna check it out...

deleted 4y ago

[deleted]

Terretta 4y ago

Livingston Portmaster 3 PM3A-1E is a RAS (Remote Access Server) that: - terminates one 1E line (30 B-channels) - provides ISDN dial-up on those channels - provides DSP based modems in case analog modem calls should be handled This was a key component of being an ISP in early days. https://osmocom.org/projects/retronetworking/wiki/Livingston_Portmaster_3 https://osmocom.org/projects/retronetworking/wiki/Livingston...

deleted 4y ago
[deleted]
mlyle 4y ago
I just bought an AS5300 to play with a few months ago to see if I could get 56k modem connections to work over VOIP. SIP channels -> voice card -> out a T1 (network) -> in another T1 (CPE) -> to DSP modem. (Or dialout, DSP modem -> out a T1 (CPE) -> in a T1 (network) -> voice card -> SIP. It just -doesn't quite- work. I can get 14400 no problem, but V.90 doesn't seem to entrain. Still troubleshooting (could be undesirable jitter buffer settings on my ISP side). I just barely missed end-of-sales of ISDN BRI in my area which could have been useful for get to the PSTN at high quality.

yumswiss 4y ago

I’ve been using this for couple months now on linux. Impressive piece of software. No issues so far.

dns_snek 4y ago

Neat product! I have a couple of questions, mainly surrounding the SPN. * How does SPN differ from a VPN, in detail? In other comments you said that it's similar to Tor, but what does that actually mean? * Does traffic get routed through multiple nodes before being routed to the destination? If not, what sets it apart from a VPN - apart from being able to choose different servers for every program on your PC? * Is SPN intended to provide privacy against nation-state actors where simply masking your exit node is not sufficient, similar to what Tor claims to do? * Who operates exit nodes (and any intermediary nodes in the SPN network), are they owned or rented dedicated servers, and does it include residential connections - to provide unblocking for streaming services? * Is traffic routed through other Portmaster users' internet connections?

dhaavi 4y ago
Q: How does SPN differ from a VPN, in detail? In other comments you said that it's similar to Tor, but what does that actually mean? If you haven't read these post [0][1] already, please do so and come back with any remaining questions! [0] https://safing.io/blog/2022/09/06/spn-vs-vpns/ https://safing.io/blog/2022/09/06/spn-vs-vpns/ [1] https://safing.io/blog/2020/01/22/how-the-spn-compares-to-tor/ https://safing.io/blog/2020/01/22/how-the-spn-compares-to-to... Q: Does traffic get routed through multiple nodes before being routed to the destination? If not, what sets it apart from a VPN - apart from being able to choose different servers for every program on your PC? Yes. And you can configure how much of that you want - per App: https://docs.safing.io/portmaster/settings#spn/routingAlgorithm https://docs.safing.io/portmaster/settings#spn/routingAlgori... Q: Is SPN intended to provide privacy against nation-state actors where simply masking your exit node is not sufficient, similar to what Tor claims to do? "Nation-state actor" is a bit vague, assuming the most common meaning (IMO): a global passive adversary. Quoting from the Tor design document: A global passive adversary is the most commonly assumed threat when analyzing theoretical anonymity designs. But like all practical low-latency systems, Tor does not protect against such a strong adversary. Neither Tor, or the SPN (or anything else) will protect you from this. If they can really see everything, they will find you - sooner or later. What we aim for is to stop exposing you to the data sources of the mass surveillance dragnet: Online tracking and the Internet-network itself. Q: Who operates exit nodes (and any intermediary nodes in the SPN network), are they owned or rented dedicated servers, and does it include residential connections - to provide unblocking for streaming services? Currently we rent servers, but will start adding our own dedicated ones once the scale is there. Nodes are also hosted by the community to diversify the node ownership in order to strengthen the privacy protection. Currently not using residential connections. Q: Is traffic routed through other Portmaster users' internet connections? No.