Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am looking for some kind of personal firewall for Linux, that will monitor all outgoing connections and show me a message asking for permission to open that connection. Like the popular personal firewalls for Windows.

Does something like this exist?


locked by HopelessN00b Dec 5 at 9:08

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

closed as off topic by sysadmin1138 Jul 10 '11 at 23:32

Questions on Server Fault are expected to relate to professional server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

try looking at firestarter as a gui front end for iptables. –  wakingrufus Apr 19 '09 at 13:12

7 Answers 7

Firestarter or Guarddog would be the friendliest GUI interface to iptables.

But the short of it is... No, there doesn't seem to be an all-in-one firewall programme with popup notification.

< ubottu> Ubuntu, like any other linux  distribution, has firewall capabilities built-in. The firewall is managed using the 'ufw' command (see 
            https://help.ubuntu.com/community/Uncomplicated_Firewall_ufw), or 'iptables' (https://help.ubuntu.com/community/IptablesHowTo). GUI 
            applications such as Firestarter/Gufw (Gnome) or Guarddog (KDE) also exist
Both are out-of-date –  Taha Jahangir Feb 3 at 17:55

I've looked for such a thing but haven't found one (yet)... in principle it might be possible to implement this using the nfnetlink_queue functionality in IPtables, but I think that's relatively new, so I wouldn't be entirely surprised that there's no program that takes advantage of it yet.

+1 for info on where to look for a DIY approach. –  voyager Jun 19 '09 at 0:47
Thanks, although I'm not sure it exactly qualifies as DIY... I once tried to write the program but it turned out to be rather involved. I'd love to get back to it someday if only I had time... –  David Z Jun 23 '09 at 0:54

Check out the Ubuntu server guide on firewalls.

I know about ufw, I am interesting in stalling the connection while popping up a dialog for the user which asks for permission to allow the connection. Preferably on a per. application basis, so the user is able to allow a specific application and not just open a specific tcp/udp port. –  bjarkef Mar 24 '09 at 12:36

You may want to take a look at AppArmor. It's somewhat similar to how Windows limits individual applications rather than setting system-wide firewall rules.

AppArmor can limit things like file accesses as well as network access. I'm not sure if it's still actively developed though.

FYI, it is most certainly still under active development by Novell/SuSE. –  MikeyB May 13 '09 at 12:50

Firestarter will show you in real-time what applications are doing what, the closest thing I know of to a Linux equivalent of ZoneAlarm (Windows) or Little Snitch (Mac OS X) is this proof of concept.

Personally tend to use FireHOL, locking down everything to begin with, and then adding applications that require Internet access one by one. If you locked down port 80 and only permitted Firefox to send traffic to destination port 80 you'd have the equivalent of only permitting Firefox to access the Internet.

It's fairly straightforward with FireHOL to deny everything by default and only permit access on a per-application (or per-user) basis. You might want to allow the root user to access using any application, but individual users can only access the Internet using specified applications, or specified ports.

Update: FireFlier looks like it will do the trick. But it's no longer in development so YMMV.


Consider looking into Leopard Flower at sourceforge.net/projects/leopardflower/

It does what you were asking for except it is CLI application


I also use Firestarter as a GUI and ufw from the command line to frontend iptables. But none of this does what the OP is asking for.

The only thing I know of that provides anything like this works only at the application level: Firekeeper is a Firefox extension that provides rule-based scanning and filtering for web traffic. It is sort of a cross between ZoneAlarm and snort for browsers. It's still in (perpetual?) alpha but seems like a good idea, and I've been running it since it was introduced with no problems. It flags suspicious get requests, XSS, and other potential exploits and asks if you want to block/allow once or whitelist/blacklist a site.


Not the answer you're looking for? Browse other questions tagged or ask your own question.