Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Portmaster 1.0 – Open-Source Network Monitor and Privacy Firewall

safing.io

Post reply on HN
Print view View original

81–90 of 117 posts

Re: Portmaster 1.0 – Open-Source Network Monitor and Privacy Firewall

#81

Post by mdip »

dhaavi wrote: post #47
OrvalWintermute wrote: post #26

Earlier quoted context omitted.

Looks intriguing. A few questions: (1) Are you planning on having support for more than 5 devices at a future point? (2) Will you have any features to support parents protection of their children? (3) How easy is it to integrate Safing into a home security stack, or an enterprise security stack? (4) Have you considered a one-time unlimited buy-in level in lieu of monthly? (5) Is this coming for iOS & MacOS? Thanks fo…

Thanks for your interest. (1) Are you planning on having support for more than 5 devices at a future point? 5 devices is what we estimate 1 user has (avg max). If there is demand, we will definitely add a plan to support more devices (or users). (2) Will you have any features to support parents protection of their children? We already collect NSFW filter lists to be activated in the settings. Otherwise such features…

Rather insightful on (2) with regard to:

    > ... we need to start protecting against the person in front of the device
My first thought was, "Oh, God, please don't". I'm a parent, if I put that software on the computer it comes with rules not to touch it; if it's touched, they know I'll probably find out, ban them from it for a bit and return it to them locked down in a manner that when I return it to its original state, they won't touch it again. :o).

But then I thought of the other common reason this kind of capability is added to software -- are you preparing for the eventual future where you will have to do this, not to protect from a child removing the software, but to protect from another app surreptitiously removing Portmaster in order to bypass its protections?

Re: Portmaster 1.0 – Open-Source Network Monitor and Privacy Firewall

#82

Post by byteshock »

dhaavi wrote: post #67
byteshock wrote: post #63

I remember trying out Portmaster on Windows earlier this year. I think Portmaster was running a local DNS server to see what connections were being made. This interfered with my VPN, Mullvad, which was trying to use a remote DNS server. Does Portmaster still require a local DNS server? I’ve been an avid user of Glasswire for years and it works flawlessly with my VPN. But i would love to switch to a open source altern…

Portmaster still (and probably always will) require a local DNS server. Why? Because there is not always and will be less ways in the future to find out which Domain an IP address belongs to. GlassWire will probably become quite blind as soon as TLS1.3 is rolled out and working as intended. I will look into Mullvad compatibility again in the coming weeks. I think they also improved some stuff on their side. User from…

Awesome, thank you for the reply. Will try out Portmaster again!

Re: Portmaster 1.0 – Open-Source Network Monitor and Privacy Firewall

#83

Post by slurpmaker »

dhaavi wrote: post #2

CTO and Co-Founder of Safing here. We're super excited to introduce version 1.0 of our network monitor and privacy firewall - Portmaster! On 1.1. this year, Portmaster was shared on HN and we hit front page [1]. With the help of our testers - many of you! - we were able to mature and develop Portmaster to hit this milestone. We're on a mission to bring privacy back to the masses. Privacy has to be easy & accessible f…

Looks like a nice project! What library are you using for a front end here?

Re: Portmaster 1.0 – Open-Source Network Monitor and Privacy Firewall

#84

Post by dhaavi »

mdip wrote: post #81
dhaavi wrote: post #47

Earlier quoted context omitted.

Thanks for your interest. (1) Are you planning on having support for more than 5 devices at a future point? 5 devices is what we estimate 1 user has (avg max). If there is demand, we will definitely add a plan to support more devices (or users). (2) Will you have any features to support parents protection of their children? We already collect NSFW filter lists to be activated in the settings. Otherwise such features…

Rather insightful on (2) with regard to: > ... we need to start protecting against the person in front of the device My first thought was, "Oh, God, please don't". I'm a parent, if I put that software on the computer it comes with rules not to touch it; if it's touched, they know I'll probably find out, ban them from it for a bit and return it to them locked down in a manner that when I return it to its original stat…

Yes. Good points.

Well, the first thing we might do is just a "Only an Administrator can make changes." setting where you only admin accounts are allowed to change settings. This one makes sense. Everything beyond that gets complicated and easy to circumvent fast.

(I also think the original question was more about blocking features and the likes.)

Protecting against other software is related, but also different. We have some decent protection here, albeit not against simply shutting Portmaster down.

Re: Portmaster 1.0 – Open-Source Network Monitor and Privacy Firewall

#85

Post by jeroenhd »

dhaavi wrote: post #69
jeroenhd wrote: post #60

Definitely one of the best firewalls for normal people on Linux. (g)UFW is nice and easy but very basic. Portmaster is a lot closer to the firewalls you may find for Windows that list applications and their statistics/configuration. My only problem with it is that under heavy load the DoH server dies or gets stuck at 50% CPU for me. It also hangs my custom DoT/DoH solution for some reason but that's not a Portmaster…

Thanks! That's exactly what we are aiming for! About your DNS issues: Have you opened an issue on GitHub yet?

I haven't had time to debug this issue yet, it mostly occurs when I'm busy with more important stuff so I usually just restart the service one or twice to get the process to behave.

I'll try to remember to collect the logs next time it happens so I can open a useful issue.

Re: Portmaster 1.0 – Open-Source Network Monitor and Privacy Firewall

#87

Post by tfarias »

dhaavi wrote: post #45
drdaeman wrote: post #43

Is this installed specifically on the endpoints or can it be installed on a network gateway (my edge router/gateway is a GNU/Linux machine) to provide analytics and security for the whole LAN? The website seems to be very light on any technical details, doesn't give me a slightest idea how it operates. Looking at the comments here I suspect it's a endpoint firewall using a VPN (SPN) to tunnel all the traffic through…

It is installed on the endpoint. It integrates with nfqueue on Linux and a kernel extension on Windows. It does not use a virtual interface. The SPN (Safing Privacy Network; VPN alternative) is optional. More details on the docs: https://docs.safing.io/

Any plans to support SPN installation on an edge router?

I have a VPN configured in my pfSense router so that I don't need to run it in each client. I guess this would make it easy to go over the 5 device limit though...

Regardless, I'll try out for the firewall and network monitoring.

Re: Portmaster 1.0 – Open-Source Network Monitor and Privacy Firewall

#88

Post by maxloh »

dhaavi wrote: post #2

CTO and Co-Founder of Safing here. We're super excited to introduce version 1.0 of our network monitor and privacy firewall - Portmaster! On 1.1. this year, Portmaster was shared on HN and we hit front page [1]. With the help of our testers - many of you! - we were able to mature and develop Portmaster to hit this milestone. We're on a mission to bring privacy back to the masses. Privacy has to be easy & accessible f…

Hi. After a quick look, I found that the codebase spread across several repos. e.g. safing/portmaster, safing/portmaster-ui and safing/portmaster-packaging.

I didn't found any guides regarding building from source. How can I build the app/installer by myself?

Re: Portmaster 1.0 – Open-Source Network Monitor and Privacy Firewall

#90

Post by maxloh »

dhaavi wrote: post #72
DavideNL wrote: post #71

Earlier quoted context omitted.

> " overrides any custom DNS server and enforces the ones the user set - or are set by default " If Portmaster " enforces DNS servers with the ones that are set ", after installing Portmaster and without the user changing anything, i'd say that's a decrease of privacy; Your VPN provider can see your traffic in any case (even when you're not using their DNS server.) So, if Portmaster would change this to whatever your…

There is a welcome screen that informs you of Portmaster handling and securing DNS queries with the option to change the provider. But especially with a VPN the privacy is increased as it effectively becomes DNS-over-TLS/HTTPS-over-VPN. The VPN still sees your destination IP addresses, so the privacy improvement is not increased by a lot, but still.

Seems that there isn't an option to use the default ISP's DNS server. :(
Post reply on HN