Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am looking for some kind of personal firewall for Linux, that will monitor all outgoing connections and show me a message asking for permission to open that connection. Like the popular personal firewalls for Windows.

Does something like this exist?

share|improve this question

closed as off topic by sysadmin1138 Jul 10 '11 at 23:32

Questions on Server Fault are expected to relate to professional server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

try looking at firestarter as a gui front end for iptables. –  wakingrufus Apr 19 '09 at 13:12
You're right. It's not programming related. Luckily, we're not on Stack Overflow and it is server-related. –  Matthew Flaschen May 13 '09 at 1:38
Matthew, this question was probably moved from Stack Overflow by Jeff. –  Ivan May 13 '09 at 1:47

7 Answers 7

Firestarter or Guarddog would be the friendliest GUI interface to iptables.

But the short of it is... No, there doesn't seem to be an all-in-one firewall programme with popup notification.

< ubottu> Ubuntu, like any other linux  distribution, has firewall capabilities built-in. The firewall is managed using the 'ufw' command (see 
            https://help.ubuntu.com/community/Uncomplicated_Firewall_ufw), or 'iptables' (https://help.ubuntu.com/community/IptablesHowTo). GUI 
            applications such as Firestarter/Gufw (Gnome) or Guarddog (KDE) also exist
share|improve this answer
Both are out-of-date –  Taha Jahangir Feb 3 at 17:55

I've looked for such a thing but haven't found one (yet)... in principle it might be possible to implement this using the nfnetlink_queue functionality in IPtables, but I think that's relatively new, so I wouldn't be entirely surprised that there's no program that takes advantage of it yet.

share|improve this answer
+1 for info on where to look for a DIY approach. –  voyager Jun 19 '09 at 0:47
Thanks, although I'm not sure it exactly qualifies as DIY... I once tried to write the program but it turned out to be rather involved. I'd love to get back to it someday if only I had time... –  David Z Jun 23 '09 at 0:54

Check out the Ubuntu server guide on firewalls.

share|improve this answer
I know about ufw, I am interesting in stalling the connection while popping up a dialog for the user which asks for permission to allow the connection. Preferably on a per. application basis, so the user is able to allow a specific application and not just open a specific tcp/udp port. –  bjarkef Mar 24 '09 at 12:36

You may want to take a look at AppArmor. It's somewhat similar to how Windows limits individual applications rather than setting system-wide firewall rules.

AppArmor can limit things like file accesses as well as network access. I'm not sure if it's still actively developed though.

share|improve this answer
FYI, it is most certainly still under active development by Novell/SuSE. –  MikeyB May 13 '09 at 12:50

Firestarter will show you in real-time what applications are doing what, the closest thing I know of to a Linux equivalent of ZoneAlarm (Windows) or Little Snitch (Mac OS X) is this proof of concept.

Personally tend to use FireHOL, locking down everything to begin with, and then adding applications that require Internet access one by one. If you locked down port 80 and only permitted Firefox to send traffic to destination port 80 you'd have the equivalent of only permitting Firefox to access the Internet.

It's fairly straightforward with FireHOL to deny everything by default and only permit access on a per-application (or per-user) basis. You might want to allow the root user to access using any application, but individual users can only access the Internet using specified applications, or specified ports.

Update: FireFlier looks like it will do the trick. But it's no longer in development so YMMV.

share|improve this answer

Consider looking into Leopard Flower at sourceforge.net/projects/leopardflower/

It does what you were asking for except it is CLI application

share|improve this answer

I also use Firestarter as a GUI and ufw from the command line to frontend iptables. But none of this does what the OP is asking for.

The only thing I know of that provides anything like this works only at the application level: Firekeeper is a Firefox extension that provides rule-based scanning and filtering for web traffic. It is sort of a cross between ZoneAlarm and snort for browsers. It's still in (perpetual?) alpha but seems like a good idea, and I've been running it since it was introduced with no problems. It flags suspicious get requests, XSS, and other potential exploits and asks if you want to block/allow once or whitelist/blacklist a site.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.