Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Portmaster 1.0 – Open-Source Network Monitor and Privacy Firewall

safing.io

Post reply on HN
Print view View original

111–117 of 117 posts

Re: Portmaster 1.0 – Open-Source Network Monitor and Privacy Firewall

#111

Post by borissk »

dhaavi wrote: post #102
borissk wrote: post #99

Earlier quoted context omitted.

Which versions of Windows do you support? Also what happens with the firewall that ships with Windows when you install Safing?

Q: Which versions of Windows do you support? Windows 10+11 full. Windows 7+8 without desktop notifications. Q: Also what happens with the firewall that ships with Windows when you install Safing? Currently nothing. It stays there and active as it is.

Thanks for the answers.

Would you recommend to manually disable the Windows firewall?

Re: Portmaster 1.0 – Open-Source Network Monitor and Privacy Firewall

#112

Post by dhaavi »

dns_snek wrote: post #110

Neat product! I have a couple of questions, mainly surrounding the SPN. * How does SPN differ from a VPN, in detail? In other comments you said that it's similar to Tor, but what does that actually mean? * Does traffic get routed through multiple nodes before being routed to the destination? If not, what sets it apart from a VPN - apart from being able to choose different servers for every program on your PC? * Is SP…

Q: How does SPN differ from a VPN, in detail? In other comments you said that it's similar to Tor, but what does that actually mean?

If you haven't read these post [0][1] already, please do so and come back with any remaining questions!

[0] https://safing.io/blog/2022/09/06/spn-vs-vpns/

[1] https://safing.io/blog/2020/01/22/how-the-spn-compares-to-to...

Q: Does traffic get routed through multiple nodes before being routed to the destination? If not, what sets it apart from a VPN - apart from being able to choose different servers for every program on your PC?

Yes. And you can configure how much of that you want - per App: https://docs.safing.io/portmaster/settings#spn/routingAlgori...

Q: Is SPN intended to provide privacy against nation-state actors where simply masking your exit node is not sufficient, similar to what Tor claims to do?

"Nation-state actor" is a bit vague, assuming the most common meaning (IMO): a global passive adversary.

Quoting from the Tor design document: A global passive adversary is the most commonly assumed threat when analyzing theoretical anonymity designs. But like all practical low-latency systems, Tor does not protect against such a strong adversary.

Neither Tor, or the SPN (or anything else) will protect you from this. If they can really see everything, they will find you - sooner or later.

What we aim for is to stop exposing you to the data sources of the mass surveillance dragnet: Online tracking and the Internet-network itself.

Q: Who operates exit nodes (and any intermediary nodes in the SPN network), are they owned or rented dedicated servers, and does it include residential connections - to provide unblocking for streaming services?

Currently we rent servers, but will start adding our own dedicated ones once the scale is there. Nodes are also hosted by the community to diversify the node ownership in order to strengthen the privacy protection. Currently not using residential connections.

Q: Is traffic routed through other Portmaster users' internet connections?

No.

Re: Portmaster 1.0 – Open-Source Network Monitor and Privacy Firewall

#113

Post by deluxeroyale »

dhaavi wrote: post #40
alibert wrote: post #16

Earlier quoted context omitted.

If you are looking for a simple and light firewall (but still better than Windows Firewall), I recommend using Simplewall. It does not require a kernel extension and works with the API provided by Windows to do network filtering. https://github.com/henrypp/simplewall

We have a blog post about this, if anyone is curious: https://safing.io/blog/2022/04/11/portmaster-vs-simplewall/

Thanks this is great, it would be nice to have one to compare with LS just for the sake of features similiar too.

Re: Portmaster 1.0 – Open-Source Network Monitor and Privacy Firewall

#114

Post by dhaavi »

maxloh wrote: post #108
dhaavi wrote: post #105

Earlier quoted context omitted.

Yes, we definitely want to improve here. The thing is that Portmaster consists of a lot of components[0]. I don't think we'll get around creating a docker image that does all the steps automatically - as far as possible. For Windows this will be infeasible for most, as you need a EV Code Signing Cert (300$+) for signing the kernel extension. Can you elaborate on your use case? [0] https://docs.safing.io/portmaster/ar…

It is not about use cases. Since Portmaster is open-source, I expected that I can modify and compile the software by myself. Maybe I will hack around when I have time. Is compiling locally not possible without the signing cert?

I understand.

Most repos have a "./pack" script that correctly builds all assets. You can then place them as "v0.0.0" (as _v0-0-0) in the updates directory. If you put Portmaster into dev mode (--devmode) it will load the v0.0.0 versions first. You might want to also disable automatic updates - or ignore the automatically downloaded versions.

Compiling for Windows without a cert works, but the OS will refuse to load the driver. You'd need to switch to a special Windows developer mode and sign it with a local certificate.

As I said, this is an area where we need to improve.

Re: Portmaster 1.0 – Open-Source Network Monitor and Privacy Firewall

#115

Post by dhaavi »

tfarias wrote: post #87
dhaavi wrote: post #45

Earlier quoted context omitted.

It is installed on the endpoint. It integrates with nfqueue on Linux and a kernel extension on Windows. It does not use a virtual interface. The SPN (Safing Privacy Network; VPN alternative) is optional. More details on the docs: https://docs.safing.io/

Any plans to support SPN installation on an edge router? I have a VPN configured in my pfSense router so that I don't need to run it in each client. I guess this would make it easy to go over the 5 device limit though... Regardless, I'll try out for the firewall and network monitoring.

Possibly, but more mid- to long-term.

The device limit is hard, but we need to limit usage somewhere, as we don't see how much bandwidth one user uses.

Can you elaborate on your use case where you have more than 5 devices?

Re: Portmaster 1.0 – Open-Source Network Monitor and Privacy Firewall

#116

Post by dhaavi »

jeroenhd wrote: post #85
dhaavi wrote: post #69

Earlier quoted context omitted.

Thanks! That's exactly what we are aiming for! About your DNS issues: Have you opened an issue on GitHub yet?

I haven't had time to debug this issue yet, it mostly occurs when I'm busy with more important stuff so I usually just restart the service one or twice to get the process to behave. I'll try to remember to collect the logs next time it happens so I can open a useful issue.

Great!

While it happens, simply go to the "Get Help" page in Portmaster and click on "Report Bug". It will collect some debug info and you can create an issue directly on GitHub from there.

Re: Portmaster 1.0 – Open-Source Network Monitor and Privacy Firewall

#117

Post by dhaavi »

ajolly wrote: post #109
dhaavi wrote: post #54

Earlier quoted context omitted.

Q: What's the performance impact on this, especially on windows? Basically negligible. Secure DNS might be a bit slower and you might feel some impact on low end devices. Q: Also what would happen if I installed a Windows gateway, using routing and remote access services, and then installed portmaster on that? You'd probably be cut off as incoming connections are blocked by default. Please place a config with excepti…

First of all, thanks for this, I've been using it today. I'll e-mail later with a longer list of comments/suggestions. First request would be a way to sync settings across multiple machines, or at least a way to import/export configs. I did get hit with the issue about having incoming connections blocked by default - realized RDP connections were blocked even from the local subnet, and had to go plug a physical monit…

> imply that I can set various settings to different tiers - 7 for trusted, for untrusted, 4 for hacked

Check out this page on the docs: https://docs.safing.io/portmaster/guides/network-rating

> sync settings across multiple machines

planned, but long-term goal.

> import/export configs

planned, short-term goal.

Post reply on HN