LuLu: An open-source macOS firewall that blocks unknown outgoing connections • Hacker News Board

Re: LuLu: An open-source macOS firewall that blocks unknown outgoing connections

#231

Post by hendersoon » Sat, Jan 20, 2018, 6:40 PM UTC

uxp wrote: post #222

ryandrake wrote: post #203

Earlier quoted context omitted.

Vanishingly few. Occasionally, I'm browsing the web and hit a text link that takes me to the browser's "I can't find this site" default screen. This usually happens with sponsored links that are not served from ad networks yet link to known ad sites.

My wife frequently complains about sponsored Google searches not resolving. She doesn't want to use an in-browser adblock, so the links will still appear, but aren't usable. Also, many redirecting analytics services from emails get blocked. Personally, I don't find these to be breaking issues for my use. My only issue is that the PiHole interface's administrative features are authenticated via the PiHole's service us…

I run pihole in a docker container on linux, so the password thing isn't a problem.

Also to people redirecting ad servers to 0.0.0.0, that can cause page damage particularly with things like iframes. Pi-hole instead redirects them to its own webserver and serves up 1x1 pixel transparent images to avoid this.

Re: LuLu: An open-source macOS firewall that blocks unknown outgoing connections

#232

Post by hendersoon » Sat, Jan 20, 2018, 6:42 PM UTC

edgartaor wrote: post #224

2dvisio wrote: post #160

Earlier quoted context omitted.

When I tried pi-hole I was amazed by it. Until the day I discovered someone in China hacked it :-///

I got tons of shh login attempts from Russia and China. I just install fail2ban.

Why is your pi-hole exposed to the internet? That's not a great idea. You could have other people using your DNS service also.

It's true it's security through obscurity and won't slow down a spear fisher, but I always change the SSH port to something like 22022 when I have to expose it to the internet and find this eliminates almost all of the portscanning/doorknob rattling. Same thing with wordpress, changing the /wp-admin directory is immensely helpful.

Re: LuLu: An open-source macOS firewall that blocks unknown outgoing connections

#233

Post by Asmod4n » Sat, Jan 20, 2018, 6:42 PM UTC

Breaks networking on High Sierra. No Browser works anymore. curl stops working. git doesn't even trigger its asking window. Power usage doubles when networking is used too.

After uninstalling it the kernel crashes.

Sad.

Re: LuLu: An open-source macOS firewall that blocks unknown outgoing connections

#234

Post by aplorbust » Sat, Jan 20, 2018, 6:43 PM UTC

srett wrote: post #217

aplorbust wrote: post #175

Earlier quoted context omitted.

What if I let the user run it locally? I point a local dnscache at a local, customised "root.zone" that blocks all these EasyList ad server domains? User could have several alternate root.zones that provide different "profiles". To switch profiles simply switch root.zones. (I used to do this for myself. Then I stopped using caches altogether. Now I do everything with tinydns, cdb and a customized stub resolver.) Or w…

A good bunch of these resolve to AWS/cloudflare/etc. nowadays, so good luck with that.. :-/

No luck needed. Authoritative DNS makes it easy.

Even without using authoritative DNS, if we only have a blocklist of IP addresses and some application-level firewall solution, we can examine outgoing HTTP headers in a client-side proxy and filter accordingly.

I also do not use a popular browser that runs Javascript to send and retrieve to and from the internet. That is the root cause of most users problems. This is the most effective solution, bar none. The third parties users want to avoid are almost almost always depending on Javascript to accomplish their goals.

Connecting a powerful interpreter with potentially full control over the users computer to the open internet. Then believing this can be safe.

The user is granting use of this interpreter to third parties. In this thread we can see how users struggle to know which third parties can be trusted. All for the sake of keeping that interpreter open to "good" third parties to access at will over the internet. (Why is a good question.)

Early web browsers called on other, separate programs to do specific jobs outside of rendering HTML. Taking a cue from that history, I use simpler, limited programs with no built-in interpreter to do two specific jobs: sending and retrieving.

Third parties can return code in response to requests for content, but I am under no obligation to run the code, let alone run it from a popular browser with a powerful interpreter that is connected to the internet.

Cannot speak for others, but this approach has worked well for me as the www worsens.

Re: LuLu: An open-source macOS firewall that blocks unknown outgoing connections

#235

Post by aplorbust » Sat, Jan 20, 2018, 6:55 PM UTC

DavideNL wrote: post #193

josho wrote: post #171

Earlier quoted context omitted.

I do this on my home network. It works well, so I encourage you to build this out. As an added bonus As a service you could point the dns entries to your own web server and serve up cat pictures or motivational pictures in place of ads.

No need to build anything: https://pi-hole.net/

The solutions I use were already "built" before this one existed. I was using djbdns to block ads before there were adblockers.

I think its great that more users, through DNS-based ad blocking projects, may see how controlling their own DNS is useful, perhaps in ways they might not have imagined.

However the last time I looked at it, I recall this project was defaulting to using open resolvers run by third parties, e.g. Google. Maybe I am remembering incorrectly since so many projects like to use these third party resolvers.

In any event, that is not how my solutions work. A third party with such delegated (ultimate) authority from the user is not part of the solutions I designed for myself.

Also, I never used dnsmasq as part of any solution. I have a strong bias against it for a number of reasons. If I recall correctly, pi-hole relies on dnsmasq.

Re: LuLu: An open-source macOS firewall that blocks unknown outgoing connections

#236

Post by culot » Sat, Jan 20, 2018, 7:04 PM UTC

fjsolwmv wrote: post #163

aplorbust wrote: post #162

Earlier quoted context omitted.

What if I start a DNS service that blocks every ad server domainname in the "EasyList"? Personally I avoid using third party DNS, but if there is demand for this...

https://adguard.com/en/adguard-dns/overview.html

I've found that unbearably slow every time I've used it.

Re: LuLu: An open-source macOS firewall that blocks unknown outgoing connections

#237

Post by matthewmcg » Sat, Jan 20, 2018, 7:20 PM UTC

ryandrake wrote: post #228

uxp wrote: post #222

Earlier quoted context omitted.

My wife frequently complains about sponsored Google searches not resolving. She doesn't want to use an in-browser adblock, so the links will still appear, but aren't usable. Also, many redirecting analytics services from emails get blocked. Personally, I don't find these to be breaking issues for my use. My only issue is that the PiHole interface's administrative features are authenticated via the PiHole's service us…

All good points. I avoid some of the headache by not using the actual PiHole software, and therefore not bringing along whatever credential baggage that comes with. Just dnsmasq, and cron to update the blocklist. My setup runs directly on my router as well, eliminating the need to maintain another box.

Are you using a Ubiquiti router for this by any chance? Would love to hear more details as I have been thinking about implementing something like this on an EdgeRouter Lite.

Re: LuLu: An open-source macOS firewall that blocks unknown outgoing connections

#238

Post by tptacek » Sat, Jan 20, 2018, 10:29 PM UTC

erAck wrote: post #18

Nowadays it's more important to control and restrict outgoing connections than incoming connections. Who would had thought of that 25 years ago.

It's not all that surprising, since modern operating systems don't accept all that many different kinds of incoming request.

Re: LuLu: An open-source macOS firewall that blocks unknown outgoing connections

#239

Post by simongr3dal » Sat, Jan 20, 2018, 11:17 PM UTC

kekebo wrote: post #219

simongr3dal wrote: post #115

Earlier quoted context omitted.

My solution right now (on macOS) is Gas Mask[1] (a menubar hosts file manager) combined with some very nice hosts files[2]. It certainly kills of most of the pop-ups I run into. [1]: https://github.com/2ndalpha/gasmask [2]: https://github.com/StevenBlack/hosts

Do you load the hosts directly as a remote pointing to the raw file? Gas Mask is complaining about "unknown content" when I try that.

I use one of the non Github mirrors that are linked in the readme, they are not https though.

Re: LuLu: An open-source macOS firewall that blocks unknown outgoing connections

#240

Post by ryandrake » Sun, Jan 21, 2018, 12:43 AM UTC

matthewmcg wrote: post #237

ryandrake wrote: post #228

Earlier quoted context omitted.

All good points. I avoid some of the headache by not using the actual PiHole software, and therefore not bringing along whatever credential baggage that comes with. Just dnsmasq, and cron to update the blocklist. My setup runs directly on my router as well, eliminating the need to maintain another box.

Are you using a Ubiquiti router for this by any chance? Would love to hear more details as I have been thinking about implementing something like this on an EdgeRouter Lite.

It's running on an ASUS router with Asuswrt-Merlin firmware.

https://gist.github.com/ryandrake08/bd2616eacbf2565243ffee74...