Outgoing firewalls that seek user-space confirmation are very effective at limiting the damage that malicious software can inflict if it gains a 'toe-hold'.
On Android, one such tool is called NetGuard. It works by installing itself as a VPN, which forces the Android OS to route all packets via its code. (It does it this way so that the user doesn't require root or
su.) So, not a VPN per se, but using the VPN function of the host operating system to achieve the goal. If you're using this software, you won't be able to have a genuine VPN running - alternatively, a tool called AFWall exists but this requires
su as it modifies the
iptables ruleset(s) for applications.
Regardless of how the packets are intercepted, either of these tools check the outgoing connection to determine whether the user has previously configured any rules for network access, or whether the application has changed. If no definitive answer is available to the software it will prompt the user, or place the request in an 'ambiguous' queue for the user to handle.
On Windows other tools exist to provide similar function, one such that I've used is called Comodo, which is a free but closed-source solution. (Please feel free to edit or comment if you know of any open source solutions - edit: can Windows Firewall do this already? Brinkmann, 2016)
On Linux there is no GUI solution that I know of that will provide this functionality. Instead, you must use the isolation functions provided by the kernel, eg. block general access to the network, then create a bridge interface, allow access to the bridge to a particular context, and then place applications that you trust within that context so they might access the bridge and the internet. At this point, you might wish to apply additional filters and rules using the
iptables (or gufw/
ufw rules-interfaces). More on bridges.
Another alternative is to use a tool called
firejail, however, this will only block programs that are launched with isolation. It relies on modifications to your
bin directories to place a link with the same name as common applications' processes to instead point to the
firejail binary. This can be circumvented trivially.
It may be possibe to run Android in a Linux container, configured to quarantine browser/ email/ etal. using AFWall, and otherwise, configuring Linux to prevent direct internet access in the manner described previously.
This answer discusses another possible solution called Douane but I have no experience with this tool.
In most of these cases you still need to configure interfaces in the kernel to limit all other activity, limiting only programs with access to the bridge, or virtual network interface, to connect to the internet.
I'm aware of a tool provided by a VPN service (Mullvad) which has an option to force all packets through the VPN tunnel. I don't know how it does this, but I suspect it uses a similar method. Feel free to comment or edit to explain this functionality.