Loading filters into opensnitch

[BullShark]

How can I load these filters into opensnitch?

https://github.com/AdguardTeam/AdguardFilters

[xenDE]

Your link has DNS blacklist and Content Filter Lists for HTML.
Use an Adblocker, not a firewall.

[BullShark]

An adblocker doesn't usually block all traffic, just the browser. You mean use my own dns server?

[xenDE]

It's DNS Blocking.

Your Link is from the https://adguard.com/ project.
https://pi-hole.net/ is another DNS Blocking project.

both you can install on your own server, for example, a cheap raspberry pi.

[BullShark]

I have a dedicated Linux vps. And I've been reading up on the different dns servers available. Bind is the known good one for Linux, but I don't think it supports all the encryption stuff. Also I'm looking into CoreDNS, Adguard. dnscrypt-proxy encrypted all of my dns even though my system doesn't support doh yet. It has great filtering, and the logging that can be turned on makes it easy to see what needs to be allowed and denied. I'm probably going to still need the dnscrypt-proxy to connect to my own server instead of public available servers because my system doesn't support the doh yet. But for filtering, it has some presets, and it's very good, dns with wildcards and ip blocking both.

[xenDE]

use local unbound, adguard, gustavo-iniguez-goya/opensnitch what ever you want to achieve.

please close this issue, its not an opensnitch related problem.

[gustavo-iniguez-goya]

I've been thinking lately in allow to load lists of suspicious/malware/ads IPs.

I think we could use lists like these ones: https://iplists.firehol.org/

But instead of creating new app rules (which would penalize performance a lot), we would have a section in the Rules tab, and the lists would be loaded into the kernel directly.

[gustavo-iniguez-goya]

I'm testing this feature, using lists from https://firebog.net/ (hosts format):

Loading blockfilter: /etc/opensnitchd/blocklists/domains/ads-and-tracking-extended.txt
domains loaded:  247650
Loading blockfilter: /etc/opensnitchd/blocklists/domains/adservers.txt
domains loaded:  341462
Loading blockfilter: /etc/opensnitchd/blocklists/domains/firstparty-trackers-hosts.txt
domains loaded:  397282
Loading blockfilter: /etc/opensnitchd/blocklists/domains/multiparty-trackers-hosts.txt
domains loaded:  408554
Loading blockfilter: /etc/opensnitchd/blocklists/domains/oisd.txt
domains loaded:  1351070
Loading blockfilter: /etc/opensnitchd/blocklists/domains/zzz-adaway-hosts.txt
domains loaded:  1351494

Total domains loaded:  1351494 Duplicated: 295552

some logs while running:

a.et.nytimes.com check took: 1.396µs
domain blocklisted:  a.et.nytimes.com 2
a.et.nytimes.com check took: 1.332µs
domain blocklisted:  a.et.nytimes.com 3
als-svc.nytimes.com check took: 1.44µs
domain blocklisted:  als-svc.nytimes.com 2
als-svc.nytimes.com check took: 1.296µs
domain blocklisted:  als-svc.nytimes.com 3
no: thumbor.forbes.com 1351494
no: thumbor.forbes.com 1351494
domain blocklisted:  geolocation.forbes.com 0
domain blocklisted:  geolocation.forbes.com 1

Pros:

• It has almost no performance penalty in terms of speed
• checking a domain costs less than 2µs.

Cons:

• lists loaded on memory.
• many applications are starting to use DoH, etc.
• depending on what lists you load, you can break many sites.

I think this approach is much better than creating app rules with the ads script of the repository.

Would be useful?

[NRGLine4Sec]

Yes it is useful, for example to block ads from Spotify.

Presently, I do it with some rules prefix by 000-deny-, but it could be definitively useful to do it with a list.

[gustavo-iniguez-goya]

Feature added, you can read more about it here:
26671de

basically create a new rule like described in the commit, create a directory where you want, and drop a list there:

$ mkdir ~/adslists/; cd ~/adslists/
$ wget https://www.github.developerdan.com/hosts/lists/ads-and-tracking-extended.txt

You can combine these lists with other fields, for example to limit a program to connect only to a certain list of domains.

If you can build it from sources and test it would be useful.

Also if you test it and have any extension to block ads using chrome/ium (uBlock origin or others), I'd interested to know if you see requests being blocked by opensnitch that in theory should be blocked by that extensions....

[gustavo-iniguez-goya]

All the instructions on how to use it have been added to the wiki: https://github.com/evilsocket/opensnitch/wiki/block-lists