23

I'm trying out Ubuntu. Been a Mac user. I like ubuntu a lot but I'm uncomfortable not having an app-firewall that reports what connections are being made to the internet. I find it unnerving to not have any control over what can & cannot connect to the internet.

Little Snitch works great on the Mac for this purpose. Is there anything comparable on Ubuntu? The default UFW firewall cannot stop apps from connecting so is pretty useless.

10
  • ufw can stop apps from connecting. you should revise your question May 10, 2012 at 19:27
  • 5
    no it can't. ufw can only block ports and IPs.
    – Lindsey
    May 10, 2012 at 19:28
  • permit port X deny any stops all apps. if what you want is dropping a specific app's traffic, you do that with ld_preload May 10, 2012 at 19:29
  • 3
    how do I permit firefox traffic over port 80 but prevent Dash from connecting to port 80?
    – Lindsey
    May 10, 2012 at 19:38
  • ld_preload - you should add that to your question May 10, 2012 at 19:40

9 Answers 9

8
+150

Linux application firewalls have not yet caught on and there have been various third party projects that come and go over the years.

Currently the best, IMO, is Leopard Flower

enter image description here

There are detailed instructions on how to install Leopard Flower here

Note: It was written for Ubuntu 10.10

Install dependencies (python-qt4 is for the graphical front end)

sudo apt-get install iptables libnetfilter-queue libnetfilter-conntrack python-qt4

Download the zip file from http://sourceforge.net/projects/leopardflower/files/latest/download

Extract the zip file

This will extract a directory, lpfw

Open a terminal and cd into the directory (Assuming it is in ~/Downloads)

cd ~/Downloads/lpfw

Run the program

sudo ./lpfw

See the above link for more detailed instructions as well as more advanced configuration.

13
  • it's not available in the repos? I have to go outside to get it? I have a practice of only installing from repos, so I'd prefer not to go outside. But I'm going to check this out. May 29, 2012 at 17:17
  • No, it is not in the repos, sorry.
    – Panther
    May 29, 2012 at 17:23
  • 1
    What does +150 mean for this answer? I hope 150 was not awarded. This is nice answer but it is not usable/installable and not even available in repos. Plus very out of date and not supported. Jun 13, 2012 at 15:21
  • 2
    Is there a activly maintained alternative to Leopard Flower? As of 2014-01-12, this project is no longer under active development. Mar 31, 2014 at 18:42
  • 2
    github.com/themighty1/lpfw seems to be the new home
    – unhammer
    Aug 7, 2015 at 10:52
7

If you are looking for a fresh application (GTK 3), have a look to my application (in heavy development) at http://douaneapp.com/

11
  • Has anyone tried this? I'd be interested in feedback, it's a very nice looking application. Any update on the process of getting listed in the Ubuntu Software Center? (per askubuntu.com/q/357002/31592 )
    – blong
    Aug 27, 2014 at 17:07
  • The application is not yet stable and will never been in the USC as they rejected my app (due to the fact that it has a kernel module ......)
    – ZedTuX
    Aug 27, 2014 at 17:54
  • Ah, alright. Well, hopefully it's stable soon. There must be some process or steps that USC recommends for applications that depend on kernel modules, right?
    – blong
    Aug 27, 2014 at 18:09
  • Well they just said to me that it's not secure. The guy hasn't gave me any tips on how to make it possible...
    – ZedTuX
    Aug 31, 2014 at 15:51
  • that stinks. Any update at this point? I feel like this app is something a lot of folks would like to use with Ubuntu, however I'd want the backing of the Ubuntu Software Center first.
    – blong
    Sep 17, 2014 at 17:21
6

Some GUI suggestions that maybe fit your needs.

Program Guard allows users of a Linux workstation to control which programs access the Internet, last updated, 2006

Progran Guard

Gufw an interface powered by ufw, last updated, 2012

Gufw

FireFlier last updated, 2009

FireFlier

Guarddog last updated, 2007.

enter image description here

TuxGuardian last updated, 2006.

enter image description here

InJoy Firewall™ commercial application (offers a 30 day trial version) last updated, 2007.

enter image description here

3
  • TuxGuardian looks like it provides what I'm looking for; however, it's no longer supported and badly out of date :( (upticked for TuxGuardian suggestion) Jun 6, 2012 at 14:26
  • @Chad--24216 I see, however check out Program Guard also --added recently to my answer
    – pl1nk
    Jun 6, 2012 at 15:39
  • Please only recommend one solution per answer post, that way, we can vote on each app separately.
    – Flimm
    Nov 16, 2022 at 10:53
3

anfd is a perl script which does the job, but it is not at all as userfriendly as little snitch. There is a good, but German wiki page. Download the script here and run it with anfd -h to see the following help text:

anfd - Ain't no firewall daemon.

anfd [-D] [-i 'iptables command'] [-x] [-c configfile] [-p pidfile]
anfd -k [-p pidfile]
anfd (-h|-?)

Anfd is a userspace daemon that uses the netfilter-ip_queue mechanism to hinder
specific software from "phoning home". It is not security software but privacy
software.

Options:
        -h, -?      : Print this help message.
        -D          : Debug mode - don't detach from terminal and print detailed infos
        -i 'command': Use this iptables command to insert the QUEUE rule.
                      Default: $ipt
        -x          : Dont insert any iptables rule. Admin will take care of that
                      herself.
        -c file     : Use this config file. Default: $default_config
        -p pidfile  : Use this pid file. Default: $pid_file
        -k          : Kill running anfd process.
3

OpenSnitch

OpenSnitch is application firewall inspired by Little Snitch that works on Ubuntu. Here's a screenshot of a prompt OpenSnitch displays when Firefox tries to connect to the Internet:

Screenshot

Installation instructions on Ubuntu 23.04 or later:

Run this command:

sudo apt install opensnitch

Now launch "OpenSnitch" from your GUI.

Installation instructions for older versions of Ubuntu:

  • Download the opensnitch and python3-opensnitch-ui .deb files from this releases page:

    • If you're using a 64 bit system, download opensnitch_1.5.2-1_amd64.deb and python3-opensnitch-ui_1.5.2-1_all.deb
    • If you're using a 32 bit system, download opensnitch_1.5.2-1_i386.deb and python3-opensnitch-ui_1.5.2-1_all.deb
    • If you're using an ARM 64 bit system, or an ARM hard float system, download the corresponding .deb files
  • Install both of these files by double clicking and installing them, or by running this on the command line:

    sudo dpkg -i Downloads/opensnitch*.deb Downloads/python3-opensnitch-ui*.deb
    
  • You can launch the OpenSnitch GUI tool by launching "OpenSnitch".

If for some reason you can't run OpenSnitch after installing it, you may be experiencing this bug (GitHub issue, Launchpad bug report). To fix it, run on the command-line:

sudo apt install python3-pip
pip3 install --ignore-installed --user grpcio==1.44.0

Pip installs modules to ~/.local/share/lib/python*, so you can delete that directory if you want to undo the previous command.

1
  • Great tip and nice how-to.
    – LarsAamo
    Nov 24, 2022 at 9:58
2

Something like this might be good to you. Firestarter looks a powerful firewall program. Might be worth giving a shot.

But I would advise just using IPtables. As stated above it can be configured with ufw for ease of use.

Ubuntu has a great documentation for its IPtables implementation. With this you dont really need an app. If you are comfortable with the cmd line then you wil be able to set up your firewall to drop everything leaving your PC. Without yourself adding a rule to allow it. eg. for example port 80 for webserver.

Once you have used IPtables you will wonder how you worked without it!

EDIT: Might find that its not so easy to get a sort of idiot proof firewall like that on Linux. And that's no way a dig at you I use it on my MacBook Pro ha! ( OSX is great imo ) Just the applications available on linux usually involve a bit more configuration.

Bill

1
  • 3
    -1: firestarter is just a network level firewall, it allows no control over per process rules.
    – airtonix
    Jun 30, 2013 at 19:52
1

Here is a guide on how to install comodo. I dont know if the program is as good as little snich. Hope that program is what you were looking for!

0

InJoy firewall is by far the best option if you can afford it. ($60)

InJoy

Hope this helps,

Leinardo

0

SELinux:

A Linux kernel integrating SELinux enforces mandatory access-control policies that confine user programs and system servers to the minimum amount of privilege they require to do their jobs. This reduces or eliminates the ability of these programs and daemons to cause harm when compromised

SELinux has been integrated into version => 2.6

http://en.wikipedia.org/wiki/Security-Enhanced_Linux http://www.nsa.gov/research/selinux/index.shtml http://www.ibm.com/developerworks/linux/library/l-selinux/enter image description here

2
  • sure would be nice if App-Armor or SELinux could be tied in with UFW/GUFW to give some sort of application awareness to the in/out of packets through the firewall. Jun 6, 2012 at 14:22
  • I remember way back that AppArmor had a gui, but they dropped it because it was not being maintained... which is a shame because it made dealing with AppArmor rules nice and easy.
    – airtonix
    Jun 30, 2013 at 19:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .