8 ms·
OpenSnitch is a GNU/Linux interactive application firewall
- vhguru 2y agoWould be great to have Arch and OpenSUSE packages too.
- amingilani 2y agoIs there an open source equivalent for MacOS?
- frankjr 2y agoThere's Lulu based on Apple's Network Extension framework but there are quite a few issues with the framework itself (it will briefly initiate a connection even though there's a deny rule for that address etc). https://github.com/objective-see/LuLu https://github.com/objective-see/LuLu
- deleted 2y ago[deleted]
- lelag 2y agoYes, there is: Lulu at https://objective-see.org/products/lulu.html https://objective-see.org/products/lulu.html.
- eep_social 2y agoI tried LuLu and it was okay but I did end up trying and subsequently buying Little Snitch. The level of UX polish wasn’t quite there for me with LuLu.
- collinvandyck76 2y agoI also feel the same way re: UX polish. I haven't bought little snitch yet, but was kind of wondering if I even needed to. I've already got a pihole on my tailnet that blocks a fair amount of things, and then ublock origin on firefox to boot. If LS were only like $20 I'd probably just buy it for the pleasing graphs, but otherwise I'm not sure what extra value it adds. There's probably a usecase for it given the other things I have, but perhaps I'm not the target audience.
- eep_social 2y agoI felt similarly, waited a long time on the trial, and grabbed it on sale for a good bit off retail after I was sure that it met my needs.
- samlinnfer 2y agoI've tried to use it extensively (as an interactive firewall). However there are just some problems (that are not the fault of OpenSnitch) that I'm not even sure that are even solvable. For example, supposed I run `curl` on the terminal, I can either always decide on a case-by-case basis to allow it thru, or I'm required to whitelist it permanently. Once I've whitelisted generic tools like `curl` or `wget`, then the floodgates are really open, since any malware that have compromised my machine can just use `curl` or `wget` to get to the internet without hitting the firewall.
- haswell 2y agoI’ve found that by using subdomain wildcards and/or subnets, I build up a stable set of rules pretty quickly and then only have to review requests to new endpoints once in awhile. To me, the peace of mind knowing that I’ll be prompted to allow new access is worth the initial hassle. And once the habit is built, it’s pretty easy to manage. Editing to add: I also use expiring rules regularly. Maybe I trust an installer and want to let it do its thing. So I open it up with a rule for the executable expiring in the near future (options include: forever, until reboot, for the next 30s, for the next 5 mins, etc). This can drastically simplify some tasks if there are a large number of endpoints for some reason and avoids leaving a hole open permanently.
- xyst 2y agoIMO - requires a ton of work. Adoption requires updating rules quite often
- haswell 2y agoSounds like that varies widely by person/use case. I’ve been using this software for a couple years at this point. I don’t have to update rules all that often (usually a few rules/week), and when I do, it’s usually a 10-30 second detour. The only time it takes more work is if I don’t know why something is trying to connect. But that’s exactly the scenario I’m targeting, i.e. calling attention to the weird looking connections. My use cases are general productivity, development on side projects and a variety of software experiments, gaming, and some local AI stuff. I also don’t see this as a ton of work. Rules are 99% pre-configured for you and all you have to do is choose the scope and duration of the rule and whether to reject or allow. I’ll admit it’s annoying once in awhile if there’s a major update to software that spawns a bunch of new rules, but once I get past the feeling of being annoyed, it’s really an extremely simple and quick process. Really have to emphasize the habit creation part. After I stuck with it for a few weeks, it became second nature and I stopped getting annoyed for the most part. I consider this a worthwhile habit to build if you’re trying lots of code/libraries and want to know what’s phoning where.
- mixmastamyk 2y agoThis is great for catching sloppy apps that make an excessive number of connections. Thunderbird, I’m looking at you. I like it, but it has a small annoyance in that the temporary rules that have expired don’t get deleted or marked in the interface. So I have to restart the gui once in a while to clear them.
- richardlblair 2y agoNot to be that guy, because I never really have the time myself. But, I'm sure PRs are welcome
- mixmastamyk 2y agoHave thought about it, though haven’t used QT in twenty years.
- TwoNineFive 2y agoActually the new Thunderbird people are not taking lots of patches and fixes for even things like security and mail corruption issues. And privacy definitely doesn't seem to be anything they are interested in. I gave up and just send them over to Betterbird, which is what I use now anyway, since I don't want my mail corrupted.
- orkj 2y agoDoes something like this exist for my phone, android specifically? Any good recommendations?
- Joe_Cool 2y agoSadly all real firewalls need root. I was using AFWall+ for a long time it has neat controls for every app to allow or deny Wifi, Cell or LAN (if you have). It is a iptables/nftables frontend so you can customize the rules to your heart's content: https://github.com/ukanth/afwall https://github.com/ukanth/afwall Works from Android 2+ Without root only VPN solutions like Adguard are available. EDIT: if you want neat stats: Glasswire has an Android version. I have only used the beta so I have no idea about its current state. Might be worth checking out though.
- ignoramous 2y agoex-AOSP and rethink dns+firewall dev here > Sadly all real firewalls need root What do you mean by a "real" firewall? It is very much possible to build a userspace firewall in Android using the VPN APIs. On Android, ROMs like GrapheneOS, Lineage, and CalyxOS have firewalls built-in. > Glasswire has an Android version Note though, Glasswire was recently acquired by another company: https://archive.is/KW2R3 https://archive.is/KW2R3
- yndoendo 2y agoI thought parts of the Android OS can by-pass the VPN so the firewall becomes ineffective against blocking Google, OEMs, and others that have root. Wouldn't the VPN API being used as a firewall also prevent one to use a VPN client at the same time?
- khimaros 2y agofor the latter, Rethink can be configured to work with eg. a wireguard VPN because it has a built-in wireguard client.
- 2y ago
- vedangvatsa 2y ago[flagged]
- vlovich123 2y agoHow does this compare with something like UFW? Is the main thing a UI to view ongoing activity?
- pull_my_finger 2y agoOpenSnitch prompts you when there's network activity. So if random app makes a telemetry call or something, you get the option to white/greylist that connection with granularity, like OK to make a connection to that address from this executable etc, or always OK to this address, and with duration options like once/for 15 seconds, until reboot etc. Once you get over the hurdle of whitelisting the apps you use and trust, it's actually pretty nice and gives you good insight into what your apps/games are doing you otherwise wouldn't have known about.
- zargon 2y agoUFW isn't an application firewall, it only blocks/allows port numbers (system-wide), as far as I know.
- irundebian 2y agoThat's right.
- irundebian 2y agoCan recommend it on Fedora over fiddling with firewalld/firewall-config.
- mixmastamyk 2y agoHow to deal with dnf looking anywhere on the continent each time it wants to update? https://news.ycombinator.com/item?id=41124755 https://news.ycombinator.com/item?id=41124755 Could just let it, but would prefer not to.
- nobody9999 2y agoAs was mentioned in the thread you linked, use 'baseurl' instead of 'metalink' in the repo definitions (in /etc/yum.repos.d) and set the update server to whichever mirror you like. There's even a helpful example in each Fedora repo that you can use as a template. Good luck.
- mixmastamyk 2y agoYep, there's six or eight of those. I don't think it's reasonable to have to change all of them, and it didn't work when I tried.
- nobody9999 2y agoMy original reply was: I guess it sucks to be you then. Which isn't very nice or helpful. So I considered mentioning (again) that there are examples that just need to be un-commented and the example url replaced. Which is perhaps a half-dozen keystrokes per file, or maybe a dozen to replace them all at once. As such, if you are, in fact, that lazy, I guess it really does suck to be you. Hosting your own private mirror[0] is also an option. But then, you'd need a couple dozen more keystrokes (and maybe ten or fifteen minutes of set up), so I'm guessing that's a no go either. I suppose you could, alternatively, add all the mirrors near you (by your own estimation) to an OpenSnitch allow list and you wouldn't have to change the repo definitions at all. DNF with metalinks will attempt to connect to additional mirrors until it can complete the current request. That said, I'm guessing setting that up is much more work than deleting, then adding a '#' character (uncomment the baseurl and comment out the metalink) and replacing a URL (the mirror you wish to use). And since you're that lazy, I imagine that's a no go too. [This isn't really relevant and I should probably remove it, but I kind of like it there. And you're welcome] I'd further add that your 'complaint' is an idiotic one at that. So you're lazy and dumb. Good combination friend. [End not relevant but not deleted text.] As I mentioned previously, although this time I'm being more expansive in my admonition: Good luck. It seems like you're gonna need it. [0] https://fedoraproject.org/wiki/Infrastructure/Mirroring#How_can_someone_make_a_private_mirror https://fedoraproject.org/wiki/Infrastructure/Mirroring#How_...? Edit: Added some additional thoughts.
- deleted 2y ago[deleted]
- stusmall 2y agoThis is what finally got me over to NixOS. In the past when I've used application firewalls its a lot of set up that often breaks on updates changing paths or I have to redo it all whenever I move to a new computer. Just tons and tons of churn and wasted effort. By integrating with the package manager that hasn't been an issue. Once I got through the initial work of setting up my whitelists I just have a little bit of effort each time I add a new package to my nix configs. If I don't want to take on the effort of adding a whitelist to my nix config, I can just add a temporary whitelist that lasts until the next reboot. It was a steep learning curve and a lot of work, but now its a breeze to maintain.
- mubu 2y agoDid you achieve this using the OpenSnitch Nix options over at search.nixos.org/options ?
- stusmall 2y agoYup. My configs can be found here: https://github.com/stusmall/nixos https://github.com/stusmall/nixos I tend to put all the random grab bags rules needed for basic functionality in the opensnitch.nix module. If a package needed rules it gets a module and they go in there. Check the signal.nix module for a good example
- mubu 2y agoVery nice, thanks!
- ranger_danger 2y agoI have tried to use it off and on many times, but all the random crashes I get really make it very difficult.
- michaelmrose 2y agoHas anyone ever in history had an issue prevented by such a firewall?
- spacebacon 2y agoResearching every connection is painstaking at first across various operating systems but a tool like this really helps you get familiar with what is normal and what is not.
- extraduder_ire 2y agoLittle snitch, the macos equivalent to this was the recommended way to stop pirated copies of Adobe CS programs phoning home for years. Don't think that's the kind of issue you meant, but it does solve it.
- stusmall 2y agoYes. Default deny application firewalls are really powerful tool. It really can take the wind out of large classes of exploits. They can't phone home to exfil data or get follow up command. It isn't something I'd recommend for everyone, because it is a lot of work and faffing around, but be extremely effective if you are willing to invest in managing it correctly.
- kerkeslager 2y agoIs there any plan to port this to MacOS? I use Little Snitch (which this is obviously influenced by) for a while, but really prefer open source (for reasons unrelated to payment).
- SettembreNero 2y agoTry LuLu
- meonkeys 2y agoI'd love something sorta like this but for Docker containers running APIs or web services. Like: containerA: all outbound traffic allowed containerB: no outbound traffic allowed, except to reply to a client containerC: may only reach out to updates.example.com Is this just per-container iptables? I could wedge iptables into existing images but it seems like a lot of work. Or maybe something with iptables on the host?
- rnmmrnm 2y agojust my two cents that netfilter (for which iptables is a frontend) is a kernel subsystem and therefore global to all containers on host.