Arch Linux

ua4000

Member

Registered: 2015-10-14

Posts: 562

[SOLVED] personal firewall - with executable control ?

Glancing over the firewall wiki I'm missing a personal firewall, like it is known under ms windows, which also covers the executable control ?

E.g. I want to allow only:

/usr/bin/firefox		http (80), https (443)
/usr/bin/thunderbird		SMTP (465), IMAP (993)
systemd-resolved		for DNS
systemd-timesyncd.service	for time-sync
xyz				for arch updates

so in this example wget, curl, rsync won't be able to fetch anything and thunderbird will not be allowed to use http/https.

The idea is to harden the system, and allow only handpicked executables handpicked internet access.

Thanks for all hints, ideas and comments.

Last edited by ua4000 (2025-11-29 11:35:15)

CarbonChauvinist

Member

Registered: 2012-06-16

Posts: 413

Website

Re: [SOLVED] personal firewall - with executable control ?

I'm not sure a direct 1:1 exists like you're expecting, you can filter/block/allow traffic by user/port/protocol using iptables/nftables/ufw etc.

You'll have to use either AppArmor or SELinux for per application hardening security rules TMK which may include network access.

---

"the wind-blown way, wanna win? don't play"

progandy

Member

Registered: 2012-05-17

Posts: 5,321

Re: [SOLVED] personal firewall - with executable control ?

OpenSnitch exists. I do not know how much that actually helps. (As soon as you want to use makepkg / the AUR you have to allow curl and maybe VCS clients or manually download all sources)

Last edited by progandy (2021-08-02 18:50:09)

---

| alias CUTF='LANG=en_XX.UTF-8@POSIX ' | alias ENGLISH='LANG=C.UTF-8 ' |

seth

Member

From: Won't reply 2 private help req

Registered: 2012-09-03

Posts: 77,372

Re: [SOLVED] personal firewall - with executable control ?

firejail allows to define individual netfilter rules per profile

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

ua4000

Member

Registered: 2015-10-14

Posts: 562

Re: [SOLVED] personal firewall - with executable control ?

thanks, opensnitch seems to go in the right direction.
Also it pointed me to the correct naming: "application firewall" is the more precise term for my task.