OpenSnitch: Difference between revisions
imported>Onny Initial page |
No edit summary |
||
| (5 intermediate revisions by one other user not shown) | |||
| Line 3: | Line 3: | ||
== Installation == | == Installation == | ||
Add following line to your system configuration to install and enable OpenSnitch | Add the following line to your system configuration to install and enable OpenSnitch: | ||
<syntaxhighlight lang="nix"> | <syntaxhighlight lang="nix"> | ||
| Line 9: | Line 9: | ||
</syntaxhighlight> | </syntaxhighlight> | ||
OpenSnitch will start blocking | OpenSnitch will start blocking connections as soon as the client application <code>opensnitch-ui</code> is connected. For [[Home Manager]] users, you can automatically start it in the background with the following configuration: | ||
<syntaxhighlight lang="nix"> | <syntaxhighlight lang="nix"> | ||
| Line 17: | Line 17: | ||
</syntaxhighlight> | </syntaxhighlight> | ||
Using this minimal and default configuration, an application which tries to connect to the outside network will be blocked. You'll see a popup window asking to grant or deny connectivity for the specific application. | Using this minimal and default configuration, an application which tries to connect to the outside network will be blocked. You'll see a popup window asking you to grant or deny connectivity for the specific application. | ||
== Configuration == | == Configuration == | ||
You can preconfigure which connections are allowed or blocked by default. The following rules will allow internet connectivity for the binaries <code>systemd-resolved</code> and <code>systemd-timesyncd</code>. All other connection requests will be blocked and require a manual exception. | |||
<syntaxhighlight lang="nix" line="1">services.opensnitch = { | |||
enable = true; | |||
<syntaxhighlight lang="nix"> | rules = { | ||
systemd-timesyncd = { | |||
created = "2018-04-07T14:13:27.903996051+02:00"; | |||
name = "systemd-timesyncd"; | |||
enabled = true; | |||
action = "allow"; | |||
duration = "always"; | |||
operator = { | |||
type ="simple"; | |||
sensitive = false; | |||
operand = "process.path"; | |||
data = "${lib.getBin pkgs.systemd}/lib/systemd/systemd-timesyncd"; | |||
}; | }; | ||
}; | |||
systemd-resolved = { | |||
created = "2018-04-07T14:13:27.903996051+02:00"; | |||
name = "systemd-resolved"; | |||
enabled = true; | |||
action = "allow"; | |||
duration = "always"; | |||
operator = { | |||
type ="simple"; | |||
sensitive = false; | |||
operand = "process.path"; | |||
data = "${lib.getBin pkgs.systemd}/lib/systemd/systemd-resolved"; | |||
}; | }; | ||
}; | }; | ||
}; | }; | ||
</syntaxhighlight> | };</syntaxhighlight> | ||
Please refer to the [https://github.com/evilsocket/opensnitch/wiki/Rules upstream documentation] for configuration syntax and additional examples. | |||
[[Category:Applications]] | [[Category:Applications]] | ||
[[Category:Security]] | [[Category:Security]] | ||
Latest revision as of 17:36, 9 July 2025
Opensnitch is a configurable inbound and outbound firewall with support for configurable rules by application, port, host, etc.
Installation
Add the following line to your system configuration to install and enable OpenSnitch:
services.opensnitch.enable = true;
OpenSnitch will start blocking connections as soon as the client application opensnitch-ui is connected. For Home Manager users, you can automatically start it in the background with the following configuration:
home-manager.users.myuser = {
services.opensnitch-ui.enable = true;
};
Using this minimal and default configuration, an application which tries to connect to the outside network will be blocked. You'll see a popup window asking you to grant or deny connectivity for the specific application.
Configuration
You can preconfigure which connections are allowed or blocked by default. The following rules will allow internet connectivity for the binaries systemd-resolved and systemd-timesyncd. All other connection requests will be blocked and require a manual exception.
services.opensnitch = {
enable = true;
rules = {
systemd-timesyncd = {
created = "2018-04-07T14:13:27.903996051+02:00";
name = "systemd-timesyncd";
enabled = true;
action = "allow";
duration = "always";
operator = {
type ="simple";
sensitive = false;
operand = "process.path";
data = "${lib.getBin pkgs.systemd}/lib/systemd/systemd-timesyncd";
};
};
systemd-resolved = {
created = "2018-04-07T14:13:27.903996051+02:00";
name = "systemd-resolved";
enabled = true;
action = "allow";
duration = "always";
operator = {
type ="simple";
sensitive = false;
operand = "process.path";
data = "${lib.getBin pkgs.systemd}/lib/systemd/systemd-resolved";
};
};
};
};
Please refer to the upstream documentation for configuration syntax and additional examples.