I'm trying out Ubuntu. Been a Mac user. I like ubuntu a lot but I'm uncomfortable not having an app-firewall that reports what connections are being made to the internet. I find it unnerving to not have any control over what can & cannot connect to the internet.

Little Snitch works great on the Mac for this purpose. Is there anything comparable on Ubuntu? The default UFW firewall cannot stop apps from connecting so is pretty useless.

  • ufw can stop apps from connecting. you should revise your question May 10 '12 at 19:27
  • 5
    no it can't. ufw can only block ports and IPs.
    – Lindsey
    May 10 '12 at 19:28
  • permit port X deny any stops all apps. if what you want is dropping a specific app's traffic, you do that with ld_preload May 10 '12 at 19:29
  • 3
    how do I permit firefox traffic over port 80 but prevent Dash from connecting to port 80?
    – Lindsey
    May 10 '12 at 19:38
  • 1
    related : brainstorm.ubuntu.com/idea/23333
    – Damien
    May 22 '12 at 12:23

Linux application firewalls have not yet caught on and there have been various third party projects that come and go over the years.

Currently the best, IMO, is Leopard Flower

enter image description here

There are detailed instructions on how to install Leopard Flower here

Note: It was written for Ubuntu 10.10

Install dependencies (python-qt4 is for the graphical front end)

sudo apt-get install iptables libnetfilter-queue libnetfilter-conntrack python-qt4

Download the zip file from http://sourceforge.net/projects/leopardflower/files/latest/download

Extract the zip file

This will extract a directory, lpfw

Open a terminal and cd into the directory (Assuming it is in ~/Downloads)

cd ~/Downloads/lpfw

Run the program

sudo ./lpfw

See the above link for more detailed instructions as well as more advanced configuration.

  • it's not available in the repos? I have to go outside to get it? I have a practice of only installing from repos, so I'd prefer not to go outside. But I'm going to check this out. May 29 '12 at 17:17
  • No, it is not in the repos, sorry.
    – Panther
    May 29 '12 at 17:23
  • @bodhi.zazen : instructions severely outdated, package must be built from source now.
    – ish
    Jun 1 '12 at 4:48
  • 1
    Is there a activly maintained alternative to Leopard Flower? As of 2014-01-12, this project is no longer under active development. Mar 31 '14 at 18:42
  • 1
    github.com/themighty1/lpfw seems to be the new home
    – unhammer
    Aug 7 '15 at 10:52

If you are looking for a fresh application (GTK 3), have a look to my application (in heavy development) at http://douaneapp.com/

  • Has anyone tried this? I'd be interested in feedback, it's a very nice looking application. Any update on the process of getting listed in the Ubuntu Software Center? (per askubuntu.com/q/357002/31592 )
    – blong
    Aug 27 '14 at 17:07
  • The application is not yet stable and will never been in the USC as they rejected my app (due to the fact that it has a kernel module ......)
    – ZedTuX
    Aug 27 '14 at 17:54
  • Ah, alright. Well, hopefully it's stable soon. There must be some process or steps that USC recommends for applications that depend on kernel modules, right?
    – blong
    Aug 27 '14 at 18:09
  • Well they just said to me that it's not secure. The guy hasn't gave me any tips on how to make it possible...
    – ZedTuX
    Aug 31 '14 at 15:51
  • that stinks. Any update at this point? I feel like this app is something a lot of folks would like to use with Ubuntu, however I'd want the backing of the Ubuntu Software Center first.
    – blong
    Sep 17 '14 at 17:21

Some GUI suggestions that maybe fit your needs.

Program Guard allows users of a Linux workstation to control which programs access the Internet, last updated, 2006

Progran Guard

Gufw an interface powered by ufw, last updated, 2012


FireFlier last updated, 2009


Guarddog last updated, 2007.

enter image description here

TuxGuardian last updated, 2006.

enter image description here

InJoy Firewall™ commercial application (offers a 30 day trial version) last updated, 2007.

enter image description here

  • TuxGuardian looks like it provides what I'm looking for; however, it's no longer supported and badly out of date :( (upticked for TuxGuardian suggestion) Jun 6 '12 at 14:26
  • @Chad--24216 I see, however check out Program Guard also --added recently to my answer
    – pl1nk
    Jun 6 '12 at 15:39

anfd is a perl script which does the job, but it is not at all as userfriendly as little snitch. There is a good, but German wiki page. Download the script here and run it with anfd -h to see the following help text:

anfd - Ain't no firewall daemon.

anfd [-D] [-i 'iptables command'] [-x] [-c configfile] [-p pidfile]
anfd -k [-p pidfile]
anfd (-h|-?)

Anfd is a userspace daemon that uses the netfilter-ip_queue mechanism to hinder
specific software from "phoning home". It is not security software but privacy

        -h, -?      : Print this help message.
        -D          : Debug mode - don't detach from terminal and print detailed infos
        -i 'command': Use this iptables command to insert the QUEUE rule.
                      Default: $ipt
        -x          : Dont insert any iptables rule. Admin will take care of that
        -c file     : Use this config file. Default: $default_config
        -p pidfile  : Use this pid file. Default: $pid_file
        -k          : Kill running anfd process.

Something like this might be good to you. Firestarter looks a powerful firewall program. Might be worth giving a shot.

But I would advise just using IPtables. As stated above it can be configured with ufw for ease of use.

Ubuntu has a great documentation for its IPtables implementation. With this you dont really need an app. If you are comfortable with the cmd line then you wil be able to set up your firewall to drop everything leaving your PC. Without yourself adding a rule to allow it. eg. for example port 80 for webserver.

Once you have used IPtables you will wonder how you worked without it!

EDIT: Might find that its not so easy to get a sort of idiot proof firewall like that on Linux. And that's no way a dig at you I use it on my MacBook Pro ha! ( OSX is great imo ) Just the applications available on linux usually involve a bit more configuration.


  • 3
    -1: firestarter is just a network level firewall, it allows no control over per process rules.
    – airtonix
    Jun 30 '13 at 19:52

Here is a guide on how to install comodo. I dont know if the program is as good as little snich. Hope that program is what you were looking for!


InJoy firewall is by far the best option if you can afford it. ($60)


Hope this helps,




A Linux kernel integrating SELinux enforces mandatory access-control policies that confine user programs and system servers to the minimum amount of privilege they require to do their jobs. This reduces or eliminates the ability of these programs and daemons to cause harm when compromised

SELinux has been integrated into version => 2.6

http://en.wikipedia.org/wiki/Security-Enhanced_Linux http://www.nsa.gov/research/selinux/index.shtml http://www.ibm.com/developerworks/linux/library/l-selinux/enter image description here

  • sure would be nice if App-Armor or SELinux could be tied in with UFW/GUFW to give some sort of application awareness to the in/out of packets through the firewall. Jun 6 '12 at 14:22
  • I remember way back that AppArmor had a gui, but they dropped it because it was not being maintained... which is a shame because it made dealing with AppArmor rules nice and easy.
    – airtonix
    Jun 30 '13 at 19:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.