Replies: 2 comments 9 replies
-
|
Hi @Bogdan107 , Your rule to allow everything from that user is correct, but the daemon only intercepts TCP, UDP and UDPLITE, so if the DefaultAction is deny, the rest of the protocols are denied. In order to allow ICMP for example, your opensnitch/daemon/system-fw.json Line 156 in 7347afd And there should be a rule added to the nftables ruleset: $ sudo nft list ruleset
table inet mangle {
chain prerouting {
type filter hook prerouting priority mangle; policy accept;
}
chain output {
type filter hook output priority mangle; policy accept;
>>>>>>>> icmp type { echo-reply, echo-request } accept
ct state related,new queue flags bypass to 0 |
Beta Was this translation helpful? Give feedback.
-
|
Take a look at the logs to see if there's any errors loading the rules. It works on all the systems I tried out (ubuntu 16-22, devuan, fedora 34-36, debian 10-11, opensuse 15), so be sure that the icmp rule is added to nftables. $ sudo nft list ruleset
table inet mangle {
chain output {
type filter hook output priority mangle; policy accept;
icmp type { echo-reply, echo-request } accept
icmpv6 type { echo-request, echo-reply } accept
ct state related,new queue flags bypass to 0
}
} |
Beta Was this translation helpful? Give feedback.
-
|
Show info about OS: Show version of program: List rules: May be table mangle not filled because table does not exists? Try to add table. Table still clean... So, opensnitchd service does not add rules into the table mangle. Logs: |
Beta Was this translation helpful? Give feedback.
-
No, the table must exist, so please, use the file from the repo, without modifying it and try again: https://github.com/evilsocket/opensnitch/blob/master/daemon/system-fw.json Notice that by default there're tables only for the On the other hand, set log level to DEBUG (/etc/opensnitchd/default-config.json LogLevel: 0), restart the daemon, and post the log file /var/log/opensnitchd.log) |
Beta Was this translation helpful? Give feedback.
-
|
Prepare default config file: Test with default config: Log file without color codes: I do not see in log, that opensnitch daemon read system-fw.json file... I have table $ nft list tables
table ip filter
table ip6 filter
table ip mangle
table ip6 mangle
table inet firewalldMay be |
Beta Was this translation helpful? Give feedback.
-
|
I change to system-fw.json/SystemRules/Enabled:true, but result the same - table |
Beta Was this translation helpful? Give feedback.
-
|
How to enable |
Beta Was this translation helpful? Give feedback.
-
|
it's not possible at the moment. |
Beta Was this translation helpful? Give feedback.
-
|
This is architecture limitations or feature just not realized? |
Beta Was this translation helpful? Give feedback.
-
|
Perhaps request it as an FR at https://github.com/evilsocket/opensnitch/issues/new?assignees=&labels=feature&projects=&template=feature-request.md&title=%5BFeature+Request%5D+%3Ctitle%3E, @Bogdan107? |
Beta Was this translation helpful? Give feedback.
-
I have config:
{ "Server": { "Address": "unix:///tmp/osui.sock", "LogFile": "/var/log/opensnitchd.log" }, "DefaultAction": "deny", "DefaultDuration": "once", "InterceptUnknown": true, "ProcMonitorMethod": "ebpf", "LogLevel": 2, "Firewall": "nftables", "Stats": { "MaxEvents": 150, "MaxStats": 25 } }I have next rule:
{ "created": "2022-07-02T19:56:53.341481525+03:00", "updated": "2022-07-02T19:56:53.341530552+03:00", "name": "user: wifi (allow: all)", "enabled": true, "precedence": true, "action": "allow", "duration": "always", "operator": { "type": "simple", "operand": "user.id", "sensitive": false, "data": "1003", "list": [] } }But commands, like
ping 1.1.1.1andmtr -t 8.8.8.8are fails.The only one trigger - is rules:
If I remove it
nft delete table ip mangle && nft delete table ip6 mangle, thenpingandmtrare worked.But them work less than a minute.
After maximum of one minute - opensnitch re-add this
manglerules andping/mtrcommands stop working.I have
Preferences/Nodes/Default action when GUI is disconnected = deny, but this option has no effect -ping/mtrare blocked in any position of this option.How to really enable full access to network for a specified user?
Beta Was this translation helpful? Give feedback.
All reactions