portmaster

Portmaster still (and probably always will) require a local DNS server. Why? Because there is not always and will be less ways in the future to find out which Domain an IP address belongs to. GlassWire will probably become quite blind as soon as TLS1.3 is rolled out and working as intended. I will look into Mullvad compatibility again in the coming weeks. I think they also improved some stuff on their side. User from 2 weeks ago: "Can confirm that Portmaster V.1.0.0 with Mullvard V2022.4 DNS set to 127.0.0.1 and the same setting on the netwerk controller both can life together." from https://github.com/safing/portmaster/issues/313

I evaluated this a few months ago and absolutely loved it. It was more polished and easier to use than I expected. Since the website made a big deal about it being alpha I went in expecting a little pain. The only major problem I hit was that everytime a snap would update it would appear as a new application and I had to reapply the rules. At the time there was a proposal for a change to fix this but it hadn't been implemented yet. I think once that lands, if it hasn't already, I'll be a loyal daily user. EDIT: Adding GitHub issue link https://github.com/safing/portmaster/issues/398

relevant GitHub issue [0] We have not investigated too much into this topic - but from what we know it would probably be easier to implement a bandwidth cap than monitoring the bandwidth. And from a priority perspective it is likely to take a while until we get to these topics, our focus lays elsewhere at the moment. [0] https://github.com/safing/portmaster/issues/382

Looks like they implemented their own windows kernel driver [1] [2] for intercepting packets. And since I see BOTH domain names and applications that won't trust custom SSL CA in their website, I guess they get the domain name from the ssl handshake packets (sni) [3] which is in plaintext [1] https://github.com/safing/portmaster/blob/22507e879be95c7b0f... [2] https://github.com/safing/portmaster-windows-kext [3] https://en.wikipedia.org/wiki/Server_Name_Indication