Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I'm trying out Ubuntu. Been a Mac user. I like ubuntu a lot but I'm uncomfortable not having an app-firewall that reports what connections are being made to the internet. I find it unnerving to not have any control over what can & cannot connect to the internet.

Little Snitch works great on the Mac for this purpose. Is there anything comparable on Ubuntu? The default UFW firewall cannot stop apps from connecting so is pretty useless.

share|improve this question
    
ufw can stop apps from connecting. you should revise your question –  hbdgaf May 10 '12 at 19:27
3  
no it can't. ufw can only block ports and IPs. –  Lindsey May 10 '12 at 19:28
    
permit port X deny any stops all apps. if what you want is dropping a specific app's traffic, you do that with ld_preload –  hbdgaf May 10 '12 at 19:29
    
how do I permit firefox traffic over port 80 but prevent Dash from connecting to port 80? –  Lindsey May 10 '12 at 19:38
1  
related : brainstorm.ubuntu.com/idea/23333 –  Damien May 22 '12 at 12:23
show 4 more comments

8 Answers

Linux application firewalls have not yet caught on and there have been various third party projects that come and go over the years.

Currently the best, IMO, is Leopard Flower

enter image description here

There are detailed instructions on how to install Leopard Flower here

Note: It was written for Ubuntu 10.10

Install dependencies (python-qt4 is for the graphical front end)

sudo apt-get install iptables libnetfilter-queue libnetfilter-conntrack python-qt4

Download the zip file from http://sourceforge.net/projects/leopardflower/files/latest/download

Extract the zip file

This will extract a directory, lpfw

Open a terminal and cd into the directory (Assuming it is in ~/Downloads)

cd ~/Downloads/lpfw

Run the program

sudo ./lpfw

See the above link for more detailed instructions as well as more advanced configuration.

share|improve this answer
    
it's not available in the repos? I have to go outside to get it? I have a practice of only installing from repos, so I'd prefer not to go outside. But I'm going to check this out. –  Chad--24216 May 29 '12 at 17:17
    
No, it is not in the repos, sorry. –  bodhi.zazen May 29 '12 at 17:23
    
@bodhi.zazen : instructions severely outdated, package must be built from source now. –  izx Jun 1 '12 at 4:48
    
@izx - OUCH !!! That is sort of the problem with application firewalls in Linux, a project pops up, but seems to fall unmaintained. Does it build from source ? –  bodhi.zazen Jun 1 '12 at 5:16
    
@bodhi.zazen: yes -- on precise, but with deps, etc. it's not a DIY for newbies. Dep names have changed, etc. Someone needs to make a deb package/PPA out of it. –  izx Jun 1 '12 at 5:18
show 6 more comments

Something like this might be good to you. Firestarter looks a powerful firewall program. Might be worth giving a shot.

But I would advise just using IPtables. As stated above it can be configured with ufw for ease of use.

Ubuntu has a great documentation for its IPtables implementation. With this you dont really need an app. If you are comfortable with the cmd line then you wil be able to set up your firewall to drop everything leaving your PC. Without yourself adding a rule to allow it. eg. for example port 80 for webserver.

Once you have used IPtables you will wonder how you worked without it!

EDIT: Might find that its not so easy to get a sort of idiot proof firewall like that on Linux. And that's no way a dig at you I use it on my MacBook Pro ha! ( OSX is great imo ) Just the applications available on linux usually involve a bit more configuration.

Bill

share|improve this answer
1  
+1: iptable from command line is insuperable. –  Luca Jun 4 '12 at 21:19
1  
-1: firestarter is just a network level firewall, it allows no control over per process rules. –  airtonix Jun 30 '13 at 19:52
add comment

anfd is a perl script which does the job, but it is not at all as userfriendly as little snitch. There is a good, but German wiki page. Download the script here and run it with anfd -h to see the following help text:

anfd - Ain't no firewall daemon.

anfd [-D] [-i 'iptables command'] [-x] [-c configfile] [-p pidfile]
anfd -k [-p pidfile]
anfd (-h|-?)

Anfd is a userspace daemon that uses the netfilter-ip_queue mechanism to hinder
specific software from "phoning home". It is not security software but privacy
software.

Options:
        -h, -?      : Print this help message.
        -D          : Debug mode - don't detach from terminal and print detailed infos
        -i 'command': Use this iptables command to insert the QUEUE rule.
                      Default: $ipt
        -x          : Dont insert any iptables rule. Admin will take care of that
                      herself.
        -c file     : Use this config file. Default: $default_config
        -p pidfile  : Use this pid file. Default: $pid_file
        -k          : Kill running anfd process.
share|improve this answer
add comment

Some GUI suggestions that maybe fit your needs.

Program Guard allows users of a Linux workstation to control which programs access the Internet, last updated, 2006

Progran Guard

Gufw an interface powered by ufw, last updated, 2012

Gufw

FireFlier last updated, 2009

FireFlier

Guarddog last updated, 2007.

enter image description here

TuxGuardian last updated, 2006.

enter image description here

InJoy Firewall™ commercial application (offers a 30 day trial version) last updated, 2007.

enter image description here

share|improve this answer
    
TuxGuardian looks like it provides what I'm looking for; however, it's no longer supported and badly out of date :( (upticked for TuxGuardian suggestion) –  Chad--24216 Jun 6 '12 at 14:26
    
@Chad--24216 I see, however check out Program Guard also --added recently to my answer –  pl1nk Jun 6 '12 at 15:39
add comment

If you are looking for a fresh application (GTK 3), have a look to my application (in heavy development) at http://douaneapp.com/

share|improve this answer
add comment

Here is a guide on how to install comodo. I dont know if the program is as good as little snich. Hope that program is what you were looking for!

share|improve this answer
add comment

InJoy firewall is by far the best option if you can afford it. ($60)

InJoy

Hope this helps,

Leinardo

share|improve this answer
add comment

SELinux:

A Linux kernel integrating SELinux enforces mandatory access-control policies that confine user programs and system servers to the minimum amount of privilege they require to do their jobs. This reduces or eliminates the ability of these programs and daemons to cause harm when compromised

SELinux has been integrated into version => 2.6

http://en.wikipedia.org/wiki/Security-Enhanced_Linux http://www.nsa.gov/research/selinux/index.shtml http://www.ibm.com/developerworks/linux/library/l-selinux/enter image description here

share|improve this answer
    
sure would be nice if App-Armor or SELinux could be tied in with UFW/GUFW to give some sort of application awareness to the in/out of packets through the firewall. –  Chad--24216 Jun 6 '12 at 14:22
    
I remember way back that AppArmor had a gui, but they dropped it because it was not being maintained... which is a shame because it made dealing with AppArmor rules nice and easy. –  airtonix Jun 30 '13 at 19:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.