Skip to content
Intelligent application firewall
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
analytics/algs
core
firewall
intel
nameserver
network
pmctl
process
profile
status
threats
ui
updates
.gitignore
AUTHORS
LICENSE
README.md
TRADEMARKS
build
dnsonly.go
main.go
pack
pack_core

README.md

Portmaster

The Portmaster enables you to protect your data on your device. You are back in charge of your outgoing connections: you choose what data you share and what data stays private. Read more on docs.safing.io.

Current Status

The Portmaster is currently in alpha. Expect dragons.
Supported platforms:

  • linux_amd64
  • windows_amd64 (soon)
  • darwin_amd64 (later)

Using the Alpha Version

Must-Know Basics

The Portmaster is all about protecting your privacy. As soon as it starts, it will start to intercept network connections. If other programs are already running, this may cause them to lose Internet connectivity for a short duration.

The main way to configure the application firewall is by configuring application profiles. For every program that is active on the network the Portmaster automatically creates a profile for it the first it's seen. These profiles are empty at first and only fed by a fallback profile. By changing these profiles in the app, you change what programs are allowed to do.

You can also see what is going on right now. The monitor page in the app lets you see the network like the Portmaster sees it: Communications represent a logical connection between a program and a domain. These second level objects group Links (physical connections: IP->IP) together for easier handling and viewing.

The Portmaster consists of three parts:

  • The core (ie. the daemon) that runs as an administrator and does all the work. (sudo ./pmctl run core --db=/opt/pm_db)
  • The app, a user interface to set preferences, monitor apps and configure application profiles (sudo ./pmctl run app --db=/opt/pm_db)
  • The notifier, a little menu/tray app for quick access and notifications (sudo ./pmctl run notifier --db=/opt/pm_db)

If you want to know more, here are the docs.

Installation

The pmctl command will help you get up and running. It will bootstrap your the environment and download additional files it needs. All commands need the --db parameter with the database location, as this is where all the data and also the binaries live.

Just download pmctl from the releases page and put it somewhere comfortable. You may freely choose where you want to put the database - it needs to be the same for all commands. Here we go - run every command in a seperate terminal window:

# start the portmaster:
sudo ./pmctl run core --db=/opt/pm_db
# this will add some rules to iptables for traffic interception via nfqueue (and will clean up afterwards!)
# already active connections may not be handled correctly, please restart programs for clean behavior

# then start the app:
./pmctl run app -db=/opt/pm_db

# and the notifier:
./pmctl run notifier -db=/opt/pm_db

Feedback

We'd love to know what you think, drop by on our forum and let us know!
If you want to report a bug, please open an issue on Github.

Documentation

Documentation in progress can be found here: docs.safing.io

Usage Dependencies

Linux

  • libnetfilter_queue
    • debian/ubuntu: sudo apt-get install libnetfilter-queue1
    • fedora: sudo yum install libnetfilter_queue
    • arch: sudo pacman -S libnetfilter_queue
  • Network Manager (optional)

Windows

  • Windows 7 (with update KB3033929) or up
    • KB3033929 (a 2015 security update) is required for correctly verifying the driver signature
  • Windows Server 2016 systems must have secure boot disabled. (clarification needed)

Build Dependencies

Linux

  • libnetfilter_queue development files
    • debian/ubuntu: sudo apt-get install libnetfilter-queue-dev
    • fedora: ?
    • arch: ?
You can’t perform that action at this time.