Tell me more ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.
up vote 9 down vote favorite
5

I would like to use a software to control which program may connect to the internet. I know that this behaviour is associated with the word "firewall", but some Linux users are very upset if somebody demands a Personal Firewall. I don't want to upset you by demand such a program.
I don't want to "secure ports" or other stuff a Personal Firewall promises on Windows. I looked into iptables but it does not fit my requirements.

I saw an excellent answer here ("How to block internet access for wine applications") but it's very uncomfortable to set this up.

Is there a software that asks for each program if it may access the internet?

share|improve this question
on mac there is a software called little snitch that does this. I think there is a windows version also... – Alvar May 25 '11 at 13:47

6 Answers

up vote 2 down vote accepted

There is a Perl script in the German Ubuntu forum that seems to do that. I never tried it and I didn't take a closer look at the script, but maybe it works for you. The description is in German only so you may need a translation service (like Google Translate).

share|improve this answer
I will have a look at it. It's interesting an may be the right tool. Unfortunately, there's no gui, but it shouldn't stop me :) – guerda May 25 '11 at 11:13
up vote 2 down vote

No, it isn't possible. It also isn't part of the traditional definition of a firewall. It is something that Microsoft came up with fairly recently in an attempt to paper around their fundamentally broken OS security problems. It is considered foolhardy and unworkable in the Linux community because one program that isn't allowed can simply run another program that is and gain access that way.

If you don't like what a program is doing on the network when you run it, then don't run that program.

share|improve this answer
1  
Microsoft's firewall was not the first major firewall to offer this functionality. It wasn't even the first Windows firewall to offer it. BlackIce Defender, ZoneAlarm, and a variety of other software firewalls for Windows predate the introduction of the Windows Internet Connection Firewall by years. Furthermore, there is no such consensus in the Linux community. We often use AppArmor (or SELinux) to constrain the behavior of applications (and I wonder if AppArmor could be adapted to this purpose...). There's no reason it's "wrong" to want to control what apps can access the Internet. – Eliah Kagan Mar 20 at 13:40
And, as several other answers can attest, per-application firewall restrictions are quite possible; this functionality is built into iptables/netfilter! – Eliah Kagan Mar 20 at 13:46
No, neither netfilter nor iptables can filter per application. They can filter by user and port but not per application. – bodhi.zazen Mar 20 at 16:56
up vote 2 down vote

There is already a firewall in Ubuntu, ufw, but it is disabled by default. You can enable and use it by the command line:

https://help.ubuntu.com/8.04/serverguide/C/firewall.html

Or you can use a program with a graphical interface over it, gufw, that is installable directly from the Ubuntu Software Centre:

https://apps.ubuntu.com/cat/applications/oneiric/gufw/

If you need to block the internet access to a specific application, you can try this program which is still in beta version and it is not available in the Ubuntu Software Centre:

http://sourceforge.net/projects/leopardflower/

share|improve this answer
up vote 1 down vote

Try https://sourceforge.net/projects/leopardflower/ It has a GUI and per-application restrictions

share|improve this answer
up vote 0 down vote

@psusi: I really wish people wouldn't peddle bad and not useful information. IPTables allows one to do this, so I'd hardly consider it "foolhardy". Just saying "NO" without understanding a use case is somewhat narrow minded. http://www.debian-administration.org/article/120/Application_level_firewalling

share|improve this answer
1  
To anyone considering flagging this: This should not be a comment instead, it answers the question that was asked. @user141987 I do recommend expanding this to provide more information about how to set up iptables to implement per-application restrictions, however. I recommend including the important information in your answer (and still providing the link, for reference). – Eliah Kagan Mar 20 at 13:50
iptables does NOT filter by application. – bodhi.zazen Mar 20 at 16:58
That article appears to be misinformation since there is no such option. The reason why requests to create such an option in the past were rejected is because it would be inherently unreliable; an application can simply change its name. – psusi Mar 21 at 13:24
@psusi Are you saying "If your kernel was compiled with CONFIG_IP_NF_MATCH_OWNER then you can configure your iptables firewall to allow or reject packets on a per-command basis" is incorrect? Or simply that most kernels don't include the option? If this is incorrect, are there sources of information that debunk it? (Also, please note that the primary purpose of per-application firewall restrictions is not to try to make it perfectly safe to run untrusted applications. The purpose is primarily to give the user a measure of control beyond applications' built-in configuration options.) – Eliah Kagan Mar 21 at 17:27
up vote 0 down vote

For better or worse, Linux uses a different approach. There is no simple graphical interface to offer this functionality. There are many discussions on this topic on the internet and you can find interesting discussions if you google search. While debate is interesting, to date there has not been a dedicated group of programmers wanting to write and maintain this functionality.

The tools that offer this functionality in Linux are Apparmor, Selinux, and Tomoyo.

None of these tools are overly easy to learn and all have advantages and disadvantages. Personally I prefer SELinux, although SELinux has a steeper learning curve.

See:

http://www.linuxbsdos.com/2011/12/06/3-application-level-firewalls-for-linux-distributions/

There was (is) an application that has been referenced already, leopardflower. I am not sure of the status / maintance.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.