7
votes

I am looking for some kind of personal firewall for Linux, that will monitor all outgoing connections and show me a message asking for permission to open that connection. Like the popular personal firewalls for Windows.

Does something like this exist?

1
  • 2
    try looking at firestarter as a gui front end for iptables.
    – wakingrufus
    Apr 19, 2009 at 13:12

7 Answers 7

4
votes

Firestarter or Guarddog would be the friendliest GUI interface to iptables.

But the short of it is... No, there doesn't seem to be an all-in-one firewall programme with popup notification.

< ubottu> Ubuntu, like any other linux  distribution, has firewall capabilities built-in. The firewall is managed using the 'ufw' command (see 
            https://help.ubuntu.com/community/Uncomplicated_Firewall_ufw), or 'iptables' (https://help.ubuntu.com/community/IptablesHowTo). GUI 
            applications such as Firestarter/Gufw (Gnome) or Guarddog (KDE) also exist
1
2
votes

I've looked for such a thing but haven't found one (yet)... in principle it might be possible to implement this using the nfnetlink_queue functionality in IPtables, but I think that's relatively new, so I wouldn't be entirely surprised that there's no program that takes advantage of it yet.

2
  • +1 for info on where to look for a DIY approach.
    – voyager
    Jun 19, 2009 at 0:47
  • Thanks, although I'm not sure it exactly qualifies as DIY... I once tried to write the program but it turned out to be rather involved. I'd love to get back to it someday if only I had time...
    – David Z
    Jun 23, 2009 at 0:54
2
votes

Check out the Ubuntu server guide on firewalls.

1
  • 1
    I know about ufw, I am interesting in stalling the connection while popping up a dialog for the user which asks for permission to allow the connection. Preferably on a per. application basis, so the user is able to allow a specific application and not just open a specific tcp/udp port.
    – bjarkef
    Mar 24, 2009 at 12:36
2
votes

You may want to take a look at AppArmor. It's somewhat similar to how Windows limits individual applications rather than setting system-wide firewall rules.

AppArmor can limit things like file accesses as well as network access. I'm not sure if it's still actively developed though.

1
  • FYI, it is most certainly still under active development by Novell/SuSE.
    – MikeyB
    May 13, 2009 at 12:50
2
votes

Firestarter will show you in real-time what applications are doing what, the closest thing I know of to a Linux equivalent of ZoneAlarm (Windows) or Little Snitch (Mac OS X) is this proof of concept.

Personally tend to use FireHOL, locking down everything to begin with, and then adding applications that require Internet access one by one. If you locked down port 80 and only permitted Firefox to send traffic to destination port 80 you'd have the equivalent of only permitting Firefox to access the Internet.

It's fairly straightforward with FireHOL to deny everything by default and only permit access on a per-application (or per-user) basis. You might want to allow the root user to access using any application, but individual users can only access the Internet using specified applications, or specified ports.

Update: FireFlier looks like it will do the trick. But it's no longer in development so YMMV.

2
votes

Consider looking into Leopard Flower at sourceforge.net/projects/leopardflower/

It does what you were asking for except it is CLI application

1
vote

I also use Firestarter as a GUI and ufw from the command line to frontend iptables. But none of this does what the OP is asking for.

The only thing I know of that provides anything like this works only at the application level: Firekeeper is a Firefox extension that provides rule-based scanning and filtering for web traffic. It is sort of a cross between ZoneAlarm and snort for browsers. It's still in (perpetual?) alpha but seems like a good idea, and I've been running it since it was introduced with no problems. It flags suspicious get requests, XSS, and other potential exploits and asks if you want to block/allow once or whitelist/blacklist a site.

Not the answer you're looking for? Browse other questions tagged .