0

Is there a way to monitor and manage (block, unblock, log) all internet activity (mainly outoing traffic) from my computer?

For example, in my android phone I've installed a VPN tool called "Tracker Control" (from the F-Droid repository) that shows me all outgoing traffic and it's destination (google, facebook, amazon and other big brothers) which I can then (in several cases, but not all) block or unblock it.

Putting in plain words, I need a tool that shows me that software X is trying to send data to Sever Y and ask me if I allow it or not...

I've heard of tools like Wireshark, but I do not know if it can block the packets, or if is just too low level for this purpose.

Is VPN an solution? Or maybe a home made proxy server (using Apache or other software)? Or some kind of Firewall?

I don't know much about the "network fauna" besides TCP and UDP. Is there other types of internet traffic that I should be aware of?

My OS: Win7, Win10 and Linux (Xubuntu)

PS: I'm kind of a advanced user, but not a network literate.

5
  • 1
    What you're asking for is called a firewall. There is a lot of firewall software out there, with some needing more or less configuration than others. Wireshark is a network monitor - all it does is show you what is happening on the wire. VPNs have nothing to do with any of this - literally nothing. – MechMK1 Jan 20 at 13:00
  • I don't think something like this exists for Linux, and in fact I was even thinking of creating my own simple tool for this purpose. I guess it would have to run on top of iptables/ufw logging. – reed Jan 20 at 13:50
  • 1
    @reed I just found this, or the proprietary software it's based on, which seems to match the description. There's probably other projects out there too... – multithr3at3d Jan 20 at 21:35
  • Take a look at NTOP, but you may find this to be far more than you're looking for. – user10216038 Jan 21 at 4:14
  • Indeed, firewall seems the way to go on windows. So far I've tried Zone Alarm, TinyWall and PeerBlock, but none of them let me block the destination IPs, instead I must allow all connections from a particular application, which is annoying. I'd like to have an extra feature to allow only certain destination to be reach, no matter the application... Anyway I'll accept the good answer bellow due the risk these question became too vague. – Paulo Bueno Jan 22 at 1:11
1

Outgoing firewalls that seek user-space confirmation are very effective at limiting the damage that malicious software can inflict if it gains a 'toe-hold'.

On Android, one such tool is called NetGuard. It works by installing itself as a VPN, which forces the Android OS to route all packets via its code. (It does it this way so that the user doesn't require root or su.) So, not a VPN per se, but using the VPN function of the host operating system to achieve the goal. If you're using this software, you won't be able to have a genuine VPN running - alternatively, a tool called AFWall exists but this requires su as it modifies the iptables ruleset(s) for applications.

Regardless of how the packets are intercepted, either of these tools check the outgoing connection to determine whether the user has previously configured any rules for network access, or whether the application has changed. If no definitive answer is available to the software it will prompt the user, or place the request in an 'ambiguous' queue for the user to handle.

On Windows other tools exist to provide similar function, one such that I've used is called Comodo, which is a free but closed-source solution. (Please feel free to edit or comment if you know of any open source solutions - edit: can Windows Firewall do this already? Brinkmann, 2016)

On Linux there is no GUI solution that I know of that will provide this functionality. Instead, you must use the isolation functions provided by the kernel, eg. block general access to the network, then create a bridge interface, allow access to the bridge to a particular context, and then place applications that you trust within that context so they might access the bridge and the internet. At this point, you might wish to apply additional filters and rules using the iptables (or gufw/ ufw rules-interfaces). More on bridges.

Another alternative is to use a tool called firejail, however, this will only block programs that are launched with isolation. It relies on modifications to your bin directories to place a link with the same name as common applications' processes to instead point to the firejail binary. This can be circumvented trivially.

It may be possibe to run Android in a Linux container, configured to quarantine browser/ email/ etal. using AFWall, and otherwise, configuring Linux to prevent direct internet access in the manner described previously.

This answer discusses another possible solution called Douane but I have no experience with this tool.

In most of these cases you still need to configure interfaces in the kernel to limit all other activity, limiting only programs with access to the bridge, or virtual network interface, to connect to the internet.

I'm aware of a tool provided by a VPN service (Mullvad) which has an option to force all packets through the VPN tunnel. I don't know how it does this, but I suspect it uses a similar method. Feel free to comment or edit to explain this functionality.

Not the answer you're looking for? Browse other questions tagged or ask your own question.