OpenSnitch - Revision history

Gliczy at 17:36, 9 July 2025

2025-07-09T17:36:46Z

← Older revision		Revision as of 17:36, 9 July 2025
Line 3:		Line 3:
	== Installation ==		== Installation ==

	Add following line to your system configuration to install and enable OpenSnitch		Add the following line to your system configuration to install and enable OpenSnitch:

	<syntaxhighlight lang="nix">		<syntaxhighlight lang="nix">
Line 9:		Line 9:
	</syntaxhighlight>		</syntaxhighlight>

	OpenSnitch will start blocking ~~connctions~~ as soon the client application <code>opensnitch-ui</code> is connected. For [[Home Manager]] users, you can automatically start it in the background with the following configuration		OpenSnitch will start blocking connections as soon as the client application <code>opensnitch-ui</code> is connected. For [[Home Manager]] users, you can automatically start it in the background with the following configuration:

	<syntaxhighlight lang="nix">		<syntaxhighlight lang="nix">
Line 17:		Line 17:
	</syntaxhighlight>		</syntaxhighlight>

	Using this minimal and default configuration, an application which tries to connect to the outside network will be blocked. You'll see a popup window asking to grant or deny connectivity for the specific application.		Using this minimal and default configuration, an application which tries to connect to the outside network will be blocked. You'll see a popup window asking you to grant or deny connectivity for the specific application.

	== Configuration ==		== Configuration ==

	You can preconfigure which connections are allowed or blocked by default. ~~Following~~ rules will allow internet connectivity for the binaries <code>systemd-resolved</code> and <code>systemd-timesyncd</code>. All other connection requests will be blocked and require an manual exception.		You can preconfigure which connections are allowed or blocked by default. The following rules will allow internet connectivity for the binaries <code>systemd-resolved</code> and <code>systemd-timesyncd</code>. All other connection requests will be blocked and require a manual exception.

	<syntaxhighlight lang="nix">		<syntaxhighlight lang="nix" line="1">services.opensnitch = {
	services.opensnitch = {
	enable = true;		enable = true;
	rules = {		rules = {
	systemd-timesyncd = {		systemd-timesyncd = {
			created = "2018-04-07T14:13:27.903996051+02:00";
	name = "systemd-timesyncd";		name = "systemd-timesyncd";
	enabled = true;		enabled = true;
Line 40:		Line 40:
	};		};
	systemd-resolved = {		systemd-resolved = {
			created = "2018-04-07T14:13:27.903996051+02:00";
	name = "systemd-resolved";		name = "systemd-resolved";
	enabled = true;		enabled = true;
Line 52:		Line 53:
	};		};
	};		};
	};		};</syntaxhighlight>
	</syntaxhighlight>

	Please refer [https://github.com/evilsocket/opensnitch/wiki/Rules upstream documentation] for configuration syntax and additional examples.		Please refer to the [https://github.com/evilsocket/opensnitch/wiki/Rules upstream documentation] for configuration syntax and additional examples.

	[[Category:Applications]]		[[Category:Applications]]
	[[Category:Security]]		[[Category:Security]]

imported>Onny: Syntax cleanup

2023-08-13T07:54:05Z

Syntax cleanup

← Older revision		Revision as of 07:54, 13 August 2023
Line 24:		Line 24:

	<syntaxhighlight lang="nix">		<syntaxhighlight lang="nix">
	services.opensnitch = {		services.opensnitch = {
	enable = true;		enable = true;
	rules = {		rules = {
	systemd-timesyncd = {		systemd-timesyncd = {
	name = "systemd-timesyncd";		name = "systemd-timesyncd";
	enabled = true;		enabled = true;
	action = "allow";		action = "allow";
	duration = "always";		duration = "always";
	operator = {		operator = {
	type ="simple";		type ="simple";
	sensitive = false;		sensitive = false;
	operand = "process.path";		operand = "process.path";
	data = "${lib.getBin pkgs.systemd}/lib/systemd/systemd-timesyncd";		data = "${lib.getBin pkgs.systemd}/lib/systemd/systemd-timesyncd";
	};
	};		};
	systemd-resolved = {		};
	name = "systemd-resolved";		systemd-resolved = {
	enabled = true;		name = "systemd-resolved";
	action = "allow";		enabled = true;
	duration = "always";		action = "allow";
	operator = {		duration = "always";
	type ="simple";		operator = {
	sensitive = false;		type ="simple";
	operand = "process.path";		sensitive = false;
	data = "${lib.getBin pkgs.systemd}/lib/systemd/systemd-resolved";		operand = "process.path";
	};		data = "${lib.getBin pkgs.systemd}/lib/systemd/systemd-resolved";
	};		};
	};		};
	};		};
			};
	</syntaxhighlight>		</syntaxhighlight>

imported>Onny: Remove unstable note

2023-08-01T07:37:56Z

Remove unstable note

← Older revision		Revision as of 07:37, 1 August 2023
Line 20:		Line 20:

	== Configuration ==		== Configuration ==

	~~{{Note\|Parts of this instruction and module are not yet stable and will be available in the upcoming NixOS 23.05 release.}}~~

	You can preconfigure which connections are allowed or blocked by default. Following rules will allow internet connectivity for the binaries <code>systemd-resolved</code> and <code>systemd-timesyncd</code>. All other connection requests will be blocked and require an manual exception.		You can preconfigure which connections are allowed or blocked by default. Following rules will allow internet connectivity for the binaries <code>systemd-resolved</code> and <code>systemd-timesyncd</code>. All other connection requests will be blocked and require an manual exception.

imported>Onny at 09:48, 7 June 2023

2023-06-07T09:48:35Z

← Older revision		Revision as of 09:48, 7 June 2023
Line 9:		Line 9:
	</syntaxhighlight>		</syntaxhighlight>

	OpenSnitch will start blocking connctions as soon the client application <code>opensnitch-ui</code> is connected. For [[Home-Manager]] users, you can automatically start it in the background with the following configuration		OpenSnitch will start blocking connctions as soon the client application <code>opensnitch-ui</code> is connected. For [[Home Manager]] users, you can automatically start it in the background with the following configuration

	<syntaxhighlight lang="nix">		<syntaxhighlight lang="nix">

imported>Onny at 11:28, 26 November 2022

2022-11-26T11:28:05Z

← Older revision		Revision as of 11:28, 26 November 2022
Line 21:		Line 21:
	== Configuration ==		== Configuration ==

	{{Note\|Parts of this instruction and module are not yet stable and will be available in the upcoming NixOS 22.11 release.}}		{{Note\|Parts of this instruction and module are not yet stable and will be available in the upcoming NixOS 23.05 release.}}

	You can preconfigure which connections are allowed or blocked by default. Following rules will allow internet connectivity for the binaries <code>systemd-resolved</code> and <code>systemd-timesyncd</code>. All other connection requests will be blocked and require an manual exception.		You can preconfigure which connections are allowed or blocked by default. Following rules will allow internet connectivity for the binaries <code>systemd-resolved</code> and <code>systemd-timesyncd</code>. All other connection requests will be blocked and require an manual exception.

imported>Onny at 16:21, 21 November 2022

2022-11-21T16:21:10Z

← Older revision		Revision as of 16:21, 21 November 2022
Line 56:		Line 56:
	};		};
	</syntaxhighlight>		</syntaxhighlight>

			Please refer [https://github.com/evilsocket/opensnitch/wiki/Rules upstream documentation] for configuration syntax and additional examples.

	[[Category:Applications]]		[[Category:Applications]]
	[[Category:Security]]		[[Category:Security]]

imported>Onny: Initial page

2022-11-21T15:43:51Z

Initial page

New page

[https://github.com/evilsocket/opensnitch Opensnitch] is a configurable inbound and outbound firewall with support for configurable rules by application, port, host, etc.

== Installation ==

Add following line to your system configuration to install and enable OpenSnitch

<syntaxhighlight lang="nix">
services.opensnitch.enable = true;
</syntaxhighlight>

OpenSnitch will start blocking connctions as soon the client application <code>opensnitch-ui</code> is connected. For [[Home-Manager]] users, you can automatically start it in the background with the following configuration

<syntaxhighlight lang="nix">
home-manager.users.myuser = {
services.opensnitch-ui.enable = true;
};
</syntaxhighlight>

Using this minimal and default configuration, an application which tries to connect to the outside network will be blocked. You'll see a popup window asking to grant or deny connectivity for the specific application.

== Configuration ==

{{Note|Parts of this instruction and module are not yet stable and will be available in the upcoming NixOS 22.11 release.}}

You can preconfigure which connections are allowed or blocked by default. Following rules will allow internet connectivity for the binaries <code>systemd-resolved</code> and <code>systemd-timesyncd</code>. All other connection requests will be blocked and require an manual exception.

<syntaxhighlight lang="nix">
services.opensnitch = {
enable = true;
rules = {
systemd-timesyncd = {
name = "systemd-timesyncd";
enabled = true;
action = "allow";
duration = "always";
operator = {
type ="simple";
sensitive = false;
operand = "process.path";
data = "${lib.getBin pkgs.systemd}/lib/systemd/systemd-timesyncd";
};
};
systemd-resolved = {
name = "systemd-resolved";
enabled = true;
action = "allow";
duration = "always";
operator = {
type ="simple";
sensitive = false;
operand = "process.path";
data = "${lib.getBin pkgs.systemd}/lib/systemd/systemd-resolved";
};
};
};
};
</syntaxhighlight>

[[Category:Applications]]
[[Category:Security]]