What does HackerNews think of opensnitch?

OpenSnitch is a GNU/Linux port of the Little Snitch application firewall

Language: Python

#3 in Linux
#2 in Security
opensnitch has existed for a while now. I've never used it, so I can't comment on how well it works.

https://github.com/evilsocket/opensnitch

For a Little Snitch alternative on Linux have you tried OpenSnitch? https://github.com/evilsocket/opensnitch
On Linux you can use OpenSnitch [0] instead anyway.

[0] https://github.com/evilsocket/opensnitch

Oh, that is fair. I assume https://github.com/evilsocket/opensnitch doesn't work for you?
I have OpenSnitch[0] installed on Ubuntu, and when I launch the Calculator app it alerts me that Calculator tries to phone home to `imf.org` apparently for currency conversion purposes. I really don't want the International Monetary Fund in my calculator app.

[0] https://github.com/evilsocket/opensnitch

Little Snitch was a must have when I used a Mac. Open Snitch for Linux is still being maintained.

https://github.com/evilsocket/opensnitch

Not browser extensions, but firewalls where you can monitor your traffic on the OS:

(TCP View is not really a firewall however, it just lets you inspect traffic, but not block it or filter it)

https://github.com/evilsocket/opensnitch (Linux)

https://www.obdev.at/products/littlesnitch/index.html (Mac)

https://www.glasswire.com/ (Windows)

https://docs.microsoft.com/en-us/sysinternals/downloads/tcpv... (Windows)

securing a machine that is updated regularly and runs untrusted code is not realistic, monitoring network exfil is.

an exploit that cannot communicate is likely benign and easy to detect in the attempt.

monitor all outbound network connections with a gui prompt that defaults to deny. whitelist trusted domains/ip for a better experience and a bit less security.

macos has littlesnitch[1], linux has opensnitch[2], or roll your own on libnetfilterqueue[3].

bonus points if the filtering happens upstream at a router or wireguard host so a compromised machine cannot easily disable filtering.

bonus points if the filtering is at executable level granularity instead of system level.

1. https://www.obdev.at/products/littlesnitch/index.html

2. https://github.com/evilsocket/opensnitch

3. https://github.com/nathants/tinysnitch

Have a look at OpenSnitch: https://github.com/evilsocket/opensnitch

Never used it myself, only remembering it from my thesis days about essentially the same topic. I see they made the jump away from Python to Go and I'm also somewhat surprised the project is not only still active, but appears to have matured nicely. Guess I'll have to check it out now!

Here's the initial HN discussion of OpenSnitch from 5 years ago: https://news.ycombinator.com/item?id=14245270

right, I used to have a firewall that could whitelist apps in the 90s on Windows (can't remember the name)... iptables can't even do that as far as I know... but there is https://github.com/evilsocket/opensnitch that I still need to try (I no longer use Windows).
Also there's OpenSnitch for Linux, available here:

https://github.com/evilsocket/opensnitch

I don't use it all the time but it is occasionally useful (or just satisfies my curiosity about what's phoning home)

I've seen a few Linux implementations of something like Little Snitch but I would not consider any of them production datacenter ready. A balanced approach might be to do something as simple as using the "owner" module in iptables to create rules saying what service accounts on your servers are permitted to talk outbound and to where and on what ports. This example does not limit by application but you can deploy your applications to use different service accounts accomplishing essentially the same thing.

Mail server example:

  iptables -I OUTPUT -o eth0 -m owner --uid-owner postfix -p tcp --syn --dport 25 -j ACCEPT
To answer your question, here is a desktop firewall for Linux that operates like Little Snitch [1] This is not meant to be used in your server deployments.

[1] - https://github.com/evilsocket/opensnitch

I am thankful for Little Snitch and Open Snitch existence. If those tools didn't exist I will not connect to Interned at all.

Started fighting macOS telemetry and refused transition to Linux partially because of absence of LS alternative. Since Open Snitch I happily run my personal computer with PureOS. https://github.com/evilsocket/opensnitch

The amount of system mothership calling on any platform is mind boggling. And everything has "rational" and "it is inevitable" attached to it. My Firefox looks like Christmas Tree from extensions and my about:config is taking too long to set properly. What a beautiful future we are creating. :)

I want an in-and-out-app-specific firewall on linux and only then, I will be happy... something a lot like https://github.com/evilsocket/opensnitch/
This is cool, and lays the groundwork for per-directory, per-app access controls like on current macOS.

Is there a comparable thing for network access? Last I looked OpenSnitch seemed to be unmaintained, but looking just now it apparently has some commits on master recently again:

https://github.com/evilsocket/opensnitch

If you're interested in this, you may be interested in this as well: https://github.com/evilsocket/opensnitch

It has a GUI interface as well.

> There isn't even a single decent dynamic firewall with those annoying popups.

even benign apps that phone home like pulumi and terraform are fun to see and block with annoying popups.

monitoring egress really is the only realistic play. i rolled my own[1], inspired by opensnitch[2].

netfilter_queue is really great, and definitely makes annoying popup dynamic firewalls possible.

1. https://github.com/nathants/tinysnitch 2. https://github.com/evilsocket/opensnitch

https://github.com/evilsocket/opensnitch

However, if you allow everything to 80/443, the extensions would still be able to connect to their servers. Maybe the browsers should add the ability to allow/deny connections per extension.

https://github.com/gustavo-iniguez-goya/opensnitch/issues/21

An alternative that does not come with a potentially machine-bricking kernel panic bug is Opensnitch [1], last updated 14 months ago with a change to "funding.yaml" asking for donations.

A fork seems to be relatively alive [2] and I use it personally -- it works well, but is a bit of a PITA to build. Time to buy the devs a coffee...

[1] https://github.com/evilsocket/opensnitch [2] https://github.com/gustavo-iniguez-goya/opensnitch

The subject of this thread are application firewalls, like Little Snitch or https://github.com/evilsocket/opensnitch.

To be fair I haven't looked at the state of Linux app firewalls in years, maybe there's something better available, but *tables is not it.

I'm using opensnitch[1] and it can block snap requests. Pretty nifty software, but it brings my machine to its knees unless I ``` sudo service opensnitchd restart ``` once in a while.

[1] https://github.com/evilsocket/opensnitch

I've never used this myself, but OpenSnitch appears to be a popular Linux equivalent to LittleSnitch.

[1] - https://github.com/evilsocket/opensnitch

OpenSnitch looks promising. https://github.com/evilsocket/opensnitch

Tilix is very much like iTerm2. Simple to use too.

there is a project called opensnitch that supposedly does similar things on linux

https://github.com/evilsocket/opensnitch

I'm not sure how active it is (no recent activity and there seem to be a lot of forks)

I run a newsletter[0] that has a section call "Code to read" for many language.

I tried to include small/interesting repos to do weird/cool things so people can learn about it. Eg, this code: https://github.com/evilsocket/opensnitch (UI in Python but the logic is Go)

---

[0]: https://betterdev.link

I just recently got back into Linux as a part-time driver and use this for the same purpose: https://github.com/evilsocket/opensnitch

Admittedly, I'm a noob so I would be happy to hear about alternatives.

how about a 3-pronged approach:

  1) pi-hole
  2) steve blacks hosts file
  3) ublock origin


  3 = most conservative filtering configuration that can easily be tweaked from the browser
  2 = use modules (-e gambling -e porn etc)
  1 = most basic blocking configuration

this way you don't have to do much fidgeting on the router. this comes at a tradeoff for putting some of the burden on the hosts #2 & #3 but with the advantage of better usability for non-tech users.

protip: if you can live with not accessing unicode domains at all (counter measure to avoid domain squatters and some phishermen) patch[1] your dnsmasq and add this in dnsmasq.conf:

   address=/:xn--*:/0.0.0.0
[1] https://github.com/spacedingo/dnsmasq-regexp_2.76.git

EDIT: for mobile I used to have a VPS running openvpn. Make Android connect to the vpn by default routing all traffic through it. Run something like opensnitch[1] to MiTM and whitelist the mobile traffic and sinkhole shit you want to get rid off. This isn't for the fainthearted since new versions of apps might make different API calls and break your rules. Apps will just stop working. If you only have 2 or 3 apps and want to kill traffic from built-in carrier spyware it works nicely and is well worth the effort. Nice way to study what your device does. https://github.com/evilsocket/opensnitch

You might want to look at OpenSnitch [1]. It requires nfqueue and directly accessing /proc to get info in real time, which is why you'll likely never see it as part of a structured firewall builder like this.

https://github.com/evilsocket/opensnitch

There's OpenSnitch[1], though it hasn't been touched in a while. Someone needs to step up and maintain it (maybe I should do that...).

[1]: https://github.com/evilsocket/opensnitch

The author is not subtle in letting know that this is intended to be open source replacement for Little Snitch (domain!).

But at-least macOS has little snitch, closest for Linux was opensnitch which was announced on HN few months back - https://github.com/evilsocket/opensnitch/ but I'm not sure whether it's actively being developed though.