Interactive / prompting application firewall

boughtonp · 12-12-2022, 04:48 PM

I need an application firewall - i.e. interactive software that pauses connections and displays a prompt (for every connection without an existing rule), allowing the user to pick options such as (allow|deny) (port|process) (once|until logout|always), and then either drops or unpauses the connection in accordance with selection (creating a rule if appropriate).

I previously looked into this about a year ago and was disappointed by the results:

Quote:

Originally Posted by boughtonp

Neither of those projects appears in Debian or Arch repos.

* Douane is at https://douaneapp.com/ and that page includes "Warning: unfortunately the project is suffering of a kernel freeze bug that can break your machine!"
* OpenSnitch is at https://github.com/evilsocket/opensnitch and checking a few recent issues, I'm not reassured about that project either.

Searching for alternatives...
* Leopard Flower personal firewall for Linux (LPFW) was abandoned Oct 2020;
* TuxGuardian hasn't been updated since 2006;
* Portmaster is Alpha software;
* LAF appears to be vapourware;
* Picosnitch does monitoring-only (no blocking).

Looking though the Portmaster website, there's plenty of points in its favour - when they ditch Electron I might give it a try.

It seems Douane still has that bug, Portmaster is still on Electron, I still don't trust OpenSnitch, and no matches in Debian's repos.

So, does anyone know any other interactive firewalls that allow adhoc rules via GUI prompts and which are worth considering?

boughtonp · 12-14-2022, 08:01 AM

Well after a bunch more depressing searches, I have come to the conclusion that to get what I want I'll need to write my own. :/

Yet another chore, but at least it shouldn't be too bad - both iptables and nftables have libnetfilter_queue, which queues packets and asks a userspace application to deliver an accept/drop verdict. There's a Python binding, which looks to be straight-forward...

Code:

iptables -A INPUT -j NFQUEUE --queue-num 1
iptables -A OUTPUT -j NFQUEUE --queue-num 1

Code:

from netfilterqueue import NetfilterQueue

def print_and_accept(pkt):
   print(pkt)
   pkt.accept()

queue_num = 1
nfqueue = NetfilterQueue()
nfqueue.bind( queue_num , print_and_accept )
try:
   nfqueue.run()
except KeyboardInterrupt:
   print('')

nfqueue.unbind()

So I should be able to plug a simple Tk interface to display the relevant information and choices and so on.
(Not sure if nfqueue will provide process names by default, but if not Picosnitch does do that part, so I can use its method.)

Probably unlikely to happen in the next few weeks, but if after a few months someone finds this thread and I haven't posted what I end up with, feel free to prod me.

And I'm still interested if anyone knows of any existing solutions that'll save me the effort - I have more interesting projects I'd rather be progressing.

TeusLollo · 06-03-2023, 05:27 PM

Quote:

Originally Posted by boughtonp

Probably unlikely to happen in the next few weeks, but if after a few months someone finds this thread and I haven't posted what I end up with, feel free to prod me.

I'm interested, and it's been a few months. Did anything come out of it?

////// · 06-04-2023, 05:05 AM

i am interested also what you have come up with.

boughtonp · 06-04-2023, 08:31 AM

Unfortunately not - I've been tangled up in assorted other issues and haven't even managed to look at it yet. :(

tredegar · 06-04-2023, 11:49 AM

Have you considered opensnitch ?
https://www.makeuseof.com/opensnitch...twork-threats/
https://github.com/evilsocket/opensnitch

////// · 06-08-2023, 04:02 PM

Quote:

Originally Posted by tredegar

Have you considered opensnitch ?
https://www.makeuseof.com/opensnitch...twork-threats/
https://github.com/evilsocket/opensnitch

i started to play with it, it looks like a good program.

jvz · 08-22-2023, 10:43 PM

Quote:

Originally Posted by boughtonp

I previously looked into this about a year ago and was disappointed by the results:

It seems Douane still has that bug, Portmaster is still on Electron, I still don't trust OpenSnitch, and no matches in Debian's repos.

So, does anyone know any other interactive firewalls that allow adhoc rules via GUI prompts and which are worth considering?

Douane doesn't work at all for me and I don't think it has been updated in years? I also found OpenSnitch and Portmaster both miss connections such as ICMP and from some appimages, or assigns the connection to the wrong program, and I'm not sure what OpenSnitch does to my iptables but there are a few programs it makes unbearably slow to launch, whether they were allowed or not.

I tried picosnitch and so far have settled on using it for monitoring and setting Firejail to be used by default for some programs to block network access.

It may not have GUI prompts, but so far this setup has been working really well for me so I thought I'd share, and was interested if you had gotten around to making any progress with your idea.

boughtonp · 08-24-2023, 05:48 AM

Thanks jvz, but still no progress; instead I seem to be accumulating blockers that are preventing me making progress with anything. :(

jvz · 09-22-2023, 04:52 PM

Instead of blocking specific programs with firejail or using a userspace application for prompts, now I drop everything with iptables for my primary user, and created a secondary user with network access. Anything I want connecting to the internet I just run as the secondary user, and have Picosnitch running in the background to verify/alert me of any issues with my setup.

So far this gives me much better performance, and better privacy and usability. I'll report back on this after trying it for a few more weeks or if I change anything.