Douane personal firewall for GNU/Linux
douaneapp.com
Douane personal firewall for GNU/Linux
1–10 of 46 posts
Re: Douane personal firewall for GNU/Linux
#2This looks a bit like Murus Firewall for OS X. Cool project! Are there any options for exporting the rules or tweaking them in more complex ways?
Re: Douane personal firewall for GNU/Linux
#3I like the Little Snitch style "allow/deny per binary" thing. It's really unfortunate that it needs a new kernel module because current default firewalls (pf, iptables, etc.) only operate on IP addresses don't know anything about processes.
Re: Douane personal firewall for GNU/Linux
#4I like the Little Snitch style "allow/deny per binary" thing. It's really unfortunate that it needs a new kernel module because current default firewalls (pf, iptables, etc.) only operate on IP addresses don't know anything about processes.
Not true, at least according to https://www.frozentux.net/iptables-tutorial/iptables-tutoria...
Edit: Looks like that only matches the process "task command name", so it probably won't work for full paths. I guess that's why they use their own kernel module?
Edit2: Never mind. That feature disappeared with 2.6.14, 10 years ago: https://lists.netfilter.org/pipermail/netfilter/2007-January...
Re: Douane personal firewall for GNU/Linux
#5I like this.
Linux has been missing a personal firewall with good GUI for a looong time.
I'll probs give it a try on a VM and see how well it works.
Re: Douane personal firewall for GNU/Linux
#6Can't a process forge its name and icon?
Re: Douane personal firewall for GNU/Linux
#7I like the Little Snitch style "allow/deny per binary" thing. It's really unfortunate that it needs a new kernel module because current default firewalls (pf, iptables, etc.) only operate on IP addresses don't know anything about processes.
On mainline Linux SELinux can be used for this sort of thing. You can either block applications from opening certain network connections straight away, or you can use SELinux in conjunction with netfilter/iptables to filter traffic coming from certain applications. This is very powerful tool, but as always with selinux it's not exactly simple to configure.
Re: Douane personal firewall for GNU/Linux
#8I like the Little Snitch style "allow/deny per binary" thing. It's really unfortunate that it needs a new kernel module because current default firewalls (pf, iptables, etc.) only operate on IP addresses don't know anything about processes.
Netfilter can delegate the fate of a packet to userland. It can be done for all packets or only the first packet of each connection (thanks to conntrack). Userland can there easily match the packet with a local connection or a local application listening socket.
There is nothing bundled inside Netfilter for this anymore because this is racy: several unrelated processes can use the same socket. The processes may come and go whenever they want.
There is also some prior art (but it's a dead project): NuFirewall.
Re: Douane personal firewall for GNU/Linux
#9Can't a process forge its name and icon?
Yes, but I don't think that a use-case for this is to identify malware on your system. My understanding is that it is more so focused on disallowing trusted applications from sharing more data than you'd like, or phoning home [more often than you'd like].
*As always, a multi-faceted approach should be taken with security, and this isn't all you should be running if you're trying to defend yourself.
Re: Douane personal firewall for GNU/Linux
#10Nice project and makes you think why all programs are given all network access by default.
This page lists nothing under Packages but the author has actually made AUR packages for Archlinux:
https://github.com/Douane/Douane/wiki/Archlinux-Packaging
Here's a directly link to the installation instructions for anyone who'd want to try it out