5.9 KiB
Starting from version 1.4.0rc1, you can block or allow lists of domains.
Since version 1.5.0rc1 you can also use lists of IPs, network ranges and domains with regular expressions.
It can be used to block ads, trackers, malware domains or limit to what domains an application connects to.
How to add a global rule to block malware
Limiting to what domains an application can connect to
Important note: This feature may not work if your system uses systemd-resolved to resolve domains. Compiling opensnitch-dns.c eBPF module may help to workaround this problem. If blocklists don't work, change your nameserver in /etc/resolv.conf to 1.1.1.1, 9.9.9.9, etc... and see if it works.
How to add a global rule to block ads or trackers:
-
Create a new rule:
000-block-domains -
Check
[x] Enable,[x] Priority,Duration: always,[x] To this list of domains
-
Download list of domains of ads to block (choose any directory you wish):
$ mkdir /media/ads-list/
$ wget https://www.github.developerdan.com/hosts/lists/ads-and-tracking-extended.txt -O /media/ads-list/ads-and-tracking-extended.txt
Note: be sure that the files have an extension (.dat, .txt, .list, etc...). Don't drop files without extension into the directory
- Visit any website, and filter by the name of the rule
000-block-domains. You can useblock-test.developerdan.comwhich is included in the above list.
Limiting to what domains an application can connect to:
We'll create 2 rules:
- one for allow connections from an app to a limited number of domains.
- another one for deny everything from that app.
- Create 2 rules:
000-allow-app,001-deny-all-from-app 000-allow-app:
Inside /media/app/ write a file (allowlist.txt for example) with a list of domains the app can connect to in hosts format:
127.0.0.1 xxx.domain.com
Note: be sure that the file has an extension (.dat, .txt, .list, etc...).
Remember that you may need to add the domain without the subdomains (domain.com, xxx.domain.com, etc)
001-deny-all-from-app:
Notes
Lists of domains (only in version >= v1.4.x):
- It must be in hosts format:
# this is a comment, it's ignored
# https://www.github.developerdan.com/hosts/
0.0.0.0 www.domain.com
127.0.0.1 www.domain.com
Lists of domains with regular expressions (only in version >= v1.5.x):
- one regular expression per line:
# https://raw.githubusercontent.com/mmotti/pihole-regex/master/whitelist.list
adtrack(er|ing)?[0-9]*[_.-]
^analytics?[_.-]
^pixel?[-.]
^stat(s|istics)?[0-9]*[_.-]
Lists of IPs (only in version >= v1.5.x):
- One per line: IPs
# https://iplists.firehol.org/
6.7.8.9
9.8.7.6
Lists of NETs (only in version >= v1.5.x): Nets:
# https://iplists.firehol.org/
1.0.1.0/24
1.2.3.0/16
- Lines started with # are ignored. Write comments always on a new line, not after a domain.
- The domains
local,localhost,localhost.localdomainandbroadcasthostare ignored. - Whenever you save the file to disk, OpenSnitch will reload the list.
- OpenSnitch doesn't refresh periodically the list loaded, but you can do it with this script: update_adlists.sh
-
Give it execution permissions:
chmod +x update_adlists.sh -
Edit the script, and modify the adsDir path to point to the directory where you want to save the lists.
-
Add the script to your user's crontab (in this example, the script will be executed every day at 11am, 17pm and 23pm):
$ crontab -e 0 11,17,23 * * * /home/ga/utils/opensnitch/update_adlists.sh
-
Troubleshooting
When you define a blocklist/allowlist rule, the directory choosen is monitored for changes. If you delete, add or modify a file under that directory, the lists will be reloaded. You'd see these logs in /var/log/opensnitchd.log:
[2022-03-31 23:58:19] INF clearing domains lists: 2 - /etc/opensnitchd/allowlists/regexp
[2022-03-31 23:58:19] DBG Loading regexp list: /etc/opensnitchd/allowlists/regexp/allow-re.txt, size: 72
[2022-03-31 23:58:19] INF 2 regexps loaded, /etc/opensnitchd/allowlists/regexp/allow-re.txt
[2022-03-31 23:58:19] INF 2 lists loaded, 2 domains, 0 duplicated
This feature may not work if your system uses systemd-resolved to resolve domains. Compiling opensnitch-dns.c eBPF module may help to workaround this problem.
If blocklists still don't work:
- stop systemd-resolved:
systemctl stop systemd-resolved - change your nameserver in
/etc/resolv.confto 1.1.1.1, 9.9.9.9, etc... and see if it works. A simple telnet to an entry of the list should be blocked and logged accordingly.
See this issue #646 for more information.
Resources
Lists of ads, trackers, malware domains, etc that you can use:
https://filterlists.com/ (filter by Syntaxis: hosts)
https://www.github.developerdan.com/hosts/
https://github.com/StevenBlack/hosts