Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Portmaster 1.0 – Open-Source Network Monitor and Privacy Firewall

safing.io

Post reply on HN
Print view View original

61–70 of 117 posts

Re: Portmaster 1.0 – Open-Source Network Monitor and Privacy Firewall

#61

Post by byteshock »

DavideNL wrote: post #58

> Please note that pretty much all the DNS leak detection tests by the VPN providers will be a false positive, as the only thing they check is if you are using their DNS servers. Rest assured that your DNS queries are well protected by the Portmaster and there is no need to be concerned. " [1] That's a confusing statement... does this mean they change your DNS server/provider by default, if you are using a VPN? [1] h…

I think it’s because SPN uses a different IP/node per connection you make. DNS leak detection tests will ask your browser to resolve unique subdomains. If the DNS server that requests the lookup is different from your connecting IP to the website, they will say you have a DNS leak.

https://security.stackexchange.com/questions/42752/how-does-...

Re: Portmaster 1.0 – Open-Source Network Monitor and Privacy Firewall

#62

Post by csdvrx »

dhaavi wrote: post #2

CTO and Co-Founder of Safing here. We're super excited to introduce version 1.0 of our network monitor and privacy firewall - Portmaster! On 1.1. this year, Portmaster was shared on HN and we hit front page [1]. With the help of our testers - many of you! - we were able to mature and develop Portmaster to hit this milestone. We're on a mission to bring privacy back to the masses. Privacy has to be easy & accessible f…

Congrats!

Just one question: In the past, postmaster had problems with WSL2.

I documented the issue and the solution: https://www.reddit.com/r/safing/comments/ryioj7/portmaster_b...

Is it fixed now?

Re: Portmaster 1.0 – Open-Source Network Monitor and Privacy Firewall

#63

Post by byteshock »

I remember trying out Portmaster on Windows earlier this year. I think Portmaster was running a local DNS server to see what connections were being made. This interfered with my VPN, Mullvad, which was trying to use a remote DNS server.

Does Portmaster still require a local DNS server? I’ve been an avid user of Glasswire for years and it works flawlessly with my VPN. But i would love to switch to a open source alternative.

Re: Portmaster 1.0 – Open-Source Network Monitor and Privacy Firewall

#64

Post by dhaavi »

byteshock wrote: post #61
DavideNL wrote: post #58

> Please note that pretty much all the DNS leak detection tests by the VPN providers will be a false positive, as the only thing they check is if you are using their DNS servers. Rest assured that your DNS queries are well protected by the Portmaster and there is no need to be concerned. " [1] That's a confusing statement... does this mean they change your DNS server/provider by default, if you are using a VPN? [1] h…

I think it’s because SPN uses a different IP/node per connection you make. DNS leak detection tests will ask your browser to resolve unique subdomains. If the DNS server that requests the lookup is different from your connecting IP to the website, they will say you have a DNS leak. https://security.stackexchange.com/questions/42752/how-does-...

That would be true if would be resolving all DNS yourself. Nowadays everyone uses a recursive resolver. See my other answer for details about this case.

Re: Portmaster 1.0 – Open-Source Network Monitor and Privacy Firewall

#65

Post by dhaavi »

DavideNL wrote: post #58

> Please note that pretty much all the DNS leak detection tests by the VPN providers will be a false positive, as the only thing they check is if you are using their DNS servers. Rest assured that your DNS queries are well protected by the Portmaster and there is no need to be concerned. " [1] That's a confusing statement... does this mean they change your DNS server/provider by default, if you are using a VPN? [1] h…

Pretty much all VPNs use their own DNS servers. Their "DNS Leak Tests" just check if queries come from that DNS server.

Portmaster overrides any custom DNS server and enforces the ones the user set - or are set by default. This "breaks" the VPN leak test.

You'd need to use a leak test from the DNS provider for it to work.

Thanks for the feedback. I will look into improving the text.

Re: Portmaster 1.0 – Open-Source Network Monitor and Privacy Firewall

#67

Post by dhaavi »

byteshock wrote: post #63

I remember trying out Portmaster on Windows earlier this year. I think Portmaster was running a local DNS server to see what connections were being made. This interfered with my VPN, Mullvad, which was trying to use a remote DNS server. Does Portmaster still require a local DNS server? I’ve been an avid user of Glasswire for years and it works flawlessly with my VPN. But i would love to switch to a open source altern…

Portmaster still (and probably always will) require a local DNS server. Why? Because there is not always and will be less ways in the future to find out which Domain an IP address belongs to.

GlassWire will probably become quite blind as soon as TLS1.3 is rolled out and working as intended.

I will look into Mullvad compatibility again in the coming weeks. I think they also improved some stuff on their side.

User from 2 weeks ago: "Can confirm that Portmaster V.1.0.0 with Mullvard V2022.4 DNS set to 127.0.0.1 and the same setting on the netwerk controller both can life together." from https://github.com/safing/portmaster/issues/313

Re: Portmaster 1.0 – Open-Source Network Monitor and Privacy Firewall

#69

Post by dhaavi »

jeroenhd wrote: post #60

Definitely one of the best firewalls for normal people on Linux. (g)UFW is nice and easy but very basic. Portmaster is a lot closer to the firewalls you may find for Windows that list applications and their statistics/configuration. My only problem with it is that under heavy load the DoH server dies or gets stuck at 50% CPU for me. It also hangs my custom DoT/DoH solution for some reason but that's not a Portmaster…

Thanks! That's exactly what we are aiming for!

About your DNS issues: Have you opened an issue on GitHub yet?

Post reply on HN