tiny-snitch

i also built off the original opensnitch[1]. libnetfilterqueue is really great. i used bpftrace instead of ftrace to get the process metadata, but eventually removed it after frustration building bpftrace. currently it is a global inbound/outbound firewall with ui prompts. i’ve recently had success running archlinux packaged bpftrace in a privileged container, so will be adding process metadata back in soon. https://github.com/nathants/tinysnitch

did you try tinysnitch [0], opensnitch fork [1] or Douane [2]? [1] works pretty well for me. [0] https://github.com/nathants/tinysnitch [1] https://github.com/gustavo-iniguez-goya/opensnitch [2] https://github.com/Douane/Douane/

i wanted something a bit simpler, so forked and reduced. recently dropped path matching except for display in the visual prompt, simple global firewall, inbound and out. as others noted, path matching is quite janky. never saw a use of libnetfilterqueue before this, so hats off to evilsocket. https://github.com/nathants/tinysnitch