Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I would like to use a software to control which program may connect to the internet. I know that this behaviour is associated with the word "firewall", but some Linux users are very upset if somebody demands a Personal Firewall. I don't want to upset you by demand such a program.
I don't want to "secure ports" or other stuff a Personal Firewall promises on Windows. I looked into iptables but it does not fit my requirements.

I saw an excellent answer here ("How to block internet access for wine applications") but it's very uncomfortable to set this up.

Is there a software that asks for each program if it may access the internet?

share|improve this question
    
on mac there is a software called little snitch that does this. I think there is a windows version also... –  Alvar May 25 '11 at 13:47

9 Answers 9

up vote 5 down vote accepted

There is a Perl script in the German Ubuntu forum (Google-translated to English) that seems to do that. I never tried it and I didn't take a closer look at the script, but maybe it works for you. The description is in German only so you may need a translation service (like Google Translate; see above).

share|improve this answer
    
I will have a look at it. It's interesting an may be the right tool. Unfortunately, there's no gui, but it shouldn't stop me :) –  guerda May 25 '11 at 11:13

In case you're still looking for this kind of application, I am currently developing exactly that application: http://douaneapp.com/

My application blocks any unknown applications (new versions of an authorized application are blocked) and asks you if you Allow or Deny its traffic.

Have a look at the website ;-)

screen shot

share|improve this answer

There is already a firewall in Ubuntu, ufw, but it is disabled by default. You can enable and use it by the command line:

https://help.ubuntu.com/8.04/serverguide/C/firewall.html

Or you can use a program with a graphical interface over it, gufw, that is installable directly from the Ubuntu Software Centre:

https://apps.ubuntu.com/cat/applications/oneiric/gufw/

If you need to block the internet access to a specific application, you can try this program which is still in beta version and it is not available in the Ubuntu Software Centre:

http://sourceforge.net/projects/leopardflower/

share|improve this answer

@psusi: I really wish people wouldn't peddle bad and not useful information. IPTables allows one to do this, so I'd hardly consider it "foolhardy". Just saying "NO" without understanding a use case is somewhat narrow minded. http://www.debian-administration.org/article/120/Application_level_firewalling

share|improve this answer
1  
To anyone considering flagging this: This should not be a comment instead, it answers the question that was asked. @user141987 I do recommend expanding this to provide more information about how to set up iptables to implement per-application restrictions, however. I recommend including the important information in your answer (and still providing the link, for reference). –  Eliah Kagan Mar 20 '13 at 13:50
    
iptables does NOT filter by application. –  bodhi.zazen Mar 20 '13 at 16:58
    
That article appears to be misinformation since there is no such option. The reason why requests to create such an option in the past were rejected is because it would be inherently unreliable; an application can simply change its name. –  psusi Mar 21 '13 at 13:24
1  
@psusi Are you saying "If your kernel was compiled with CONFIG_IP_NF_MATCH_OWNER then you can configure your iptables firewall to allow or reject packets on a per-command basis" is incorrect? Or simply that most kernels don't include the option? If this is incorrect, are there sources of information that debunk it? (Also, please note that the primary purpose of per-application firewall restrictions is not to try to make it perfectly safe to run untrusted applications. The purpose is primarily to give the user a measure of control beyond applications' built-in configuration options.) –  Eliah Kagan Mar 21 '13 at 17:27

No, it isn't possible. It also isn't part of the traditional definition of a firewall. It is something that Microsoft came up with fairly recently in an attempt to paper around their fundamentally broken OS security problems. It is considered foolhardy and unworkable in the Linux community because one program that isn't allowed can simply run another program that is and gain access that way.

If you don't like what a program is doing on the network when you run it, then don't run that program.

share|improve this answer
3  
Microsoft's firewall was not the first major firewall to offer this functionality. It wasn't even the first Windows firewall to offer it. BlackIce Defender, ZoneAlarm, and a variety of other software firewalls for Windows predate the introduction of the Windows Internet Connection Firewall by years. Furthermore, there is no such consensus in the Linux community. We often use AppArmor (or SELinux) to constrain the behavior of applications (and I wonder if AppArmor could be adapted to this purpose...). There's no reason it's "wrong" to want to control what apps can access the Internet. –  Eliah Kagan Mar 20 '13 at 13:40
    
And, as several other answers can attest, per-application firewall restrictions are quite possible; this functionality is built into iptables/netfilter! –  Eliah Kagan Mar 20 '13 at 13:46
    
No, neither netfilter nor iptables can filter per application. They can filter by user and port but not per application. –  bodhi.zazen Mar 20 '13 at 16:56
    
"Can simply run another"???? Then obviously the creator of such a program that doesn't block the child processes of the target program is vastly flawed. –  trusktr Aug 3 '13 at 6:16

Try https://sourceforge.net/projects/leopardflower/ It has a GUI and per-application restrictions

share|improve this answer

For better or worse, Linux uses a different approach. There is no simple graphical interface to offer this functionality. There are many discussions on this topic on the internet and you can find interesting discussions if you google search. While debate is interesting, to date there has not been a dedicated group of programmers wanting to write and maintain this functionality.

The tools that offer this functionality in Linux are Apparmor, Selinux, and Tomoyo.

None of these tools are overly easy to learn and all have advantages and disadvantages. Personally I prefer SELinux, although SELinux has a steeper learning curve.

See:

http://www.linuxbsdos.com/2011/12/06/3-application-level-firewalls-for-linux-distributions/

There was (is) an application that has been referenced already, leopardflower. I am not sure of the status / maintance.

share|improve this answer

It was in iptables up to kernel version 2.6.24 If you are running a 2.x - 2.6.24 machine and your kernel has it complied in you can do it. for some reason they took it out, so no its not microsoft. http://cateee.net/lkddb/web-lkddb/IP_NF_MATCH_OWNER.html

share|improve this answer
    

I found a convenient solution that solves the problem. You create a group that is never allowed to use the internet and start the program as a member of this group.

  1. Create a group no-internet. Do not join this group.
  2. Add a rule iptables -A OUTPUT -m owner --gid-owner no-internet -j DROP to ip tables that prevents all processes belonging to the group no-internet from using the network.
  3. Execute sudo -g no-internet YOURCOMMAND instead of YOURCOMMAND.

You can easily write a wrapper script that uses sudo for you. You can get rid of the password prompt by adding

%sudo     ALL=(:no-internet)      NOPASSWD: ALL

or something similar to your /etc/sudoers.

share|improve this answer
    
I tried your guide, sudo -g no-internet firefox connects faster than default one. It doesn't work. –  kenn Apr 14 at 12:22
    
@kenn I can only say that it works fine here. I would guess that you are doing something wrong when creating the rule. Not saving the rule, not making the script executable or something like that. –  Tim Apr 14 at 13:53
    
I rebooted and applied above rules again with no luck –  kenn Apr 14 at 14:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.