Never mind

[mixmastamyk]

Figured it out!

[gustavo-iniguez-goya]

hey @mixmastamyk , what was the problem??

[mixmastamyk]

Kinda complicated, multiple layers.

First, I learned there is a difference between Deny and Reject. Those two words mean the same thing though! Deny seems to be closer to something like drop or ignore, leading to long timeout delays. Not sure why it is an option, but should be de-emphasized at least. Because the color was red, I went straight to it.

Anyway, so I changed my deny rules to reject on the specific address, but that didn't help either. Wasn't sure why. 🤔

Turns out, an unrelated problem (that I haven't figured out) was interfering. I have an OpenWRT router with DNS that provides my own little LAN domain, which I can use, e.g. ping my_other_computer.lan

For some reason programs (DNS?) always retry on *.lan. So, if I block www.microsoft.com, in a few seconds my computer will retry on www.microsoft.com.lan and opensnitch opens a dialog. Why? I have no idea, but maybe due to the Deny behavior above.

So I had to create a rule to block anything going to *.lan (except a few things like ssh etc). But that rule was old and still using Deny! So when the computer retried on the .lan address, it still got stuck waiting!

I changed the *.lan rule to Reject and my browser and curl were snappy again! Then I went thru and changed all my Deny rules to Reject. Big waste of time, and I bothered Mozilla about it as well. 😅

Also changing all the rules was more difficult than it should be in the GUI. The Rules tab/list widget doesn't support shift-mouse-click to select a range. Is it a custom widget or broken in QT? Events tab list widget shift-click sometimes works.

Also, Ctrl+A (select all) only selects the visible items and loses selection on scroll, both of which are incorrect behavior. (I should write some bugs on the list widget.)

[gustavo-iniguez-goya]

First, I learned there is a difference between Deny and Reject. Those two words mean the same thing though! Deny seems to be closer to something like drop or ignore, leading to long timeout delays. Not sure why it is an option, but should be de-emphasized at least. Because the color was red, I went straight to it.

Deny and Reject are also used in iptables and nftables, although they use Drop, Reject and Accept.
In our case Deny behaves like Drop, the connection is ignored, while Reject also ignores the connection but kills the socket that created it, so there're no new connection attempts.

For some reason programs (DNS?) always retry on *.lan. So, if I block www.microsoft.com, in a few seconds my computer will retry on www.microsoft.com.lan and opensnitch opens a dialog. Why? I have no idea, but maybe due to the Deny behavior above.

The issue is that the rule to block www.microsoft.com will only match that domain, since there's no rule to deny www.microsoft.com.lan.

Also changing all the rules was more difficult than it should be in the GUI. The Rules tab/list widget doesn't support shift-mouse-click to select a range. Is it a custom widget or broken in QT? Events tab list widget shift-click sometimes works.

It's a custom broken Qt widget :) I fixed shift+click behaviour after v1.8.0 here f898b0a and here 2807baa, but there's still one issue to fix: allow selecting more rows than the ones currently displayed.

Also, Ctrl+A (select all) only selects the visible items and loses selection on scroll, both of which are incorrect behavior. (I should write some bugs on the list widget.)

This has been fixed here (hopefully): bda2cae

Thanks for all these reports! The GUI needs more work. @tredondo has reported also a lot of GUI issues. Now that I've refactorized the main window, it should be easier to add new functionality.

These are the GUI issues I tagged for the next release: https://github.com/evilsocket/opensnitch/issues?q=is%3Aissue%20state%3Aopen%20milestone%3A1.9.0

I'd like to fix at least the shift+click bug.

[mixmastamyk]

Any thoughts? Would you support my interface recommendations above?

[mixmastamyk]

Cool thanks.

[tredondo]

Hey @mixmastamyk, as a new user, I had many of the same questions above. I still didn't know the difference between Deny and Reject until now 😅 @gustavo-iniguez-goya Sound like "Reject" should be prioritized then? Or what is the use case for Deny? If I won't want a connection to happen, I wait it killed, not just have packets dropped - if I understand correctly?

As for table selection issues - I'm curious how come these low-level bugs exist? Isn't the code using a standard table component that handles all the regular table interactions? (Sorry if this seems naive, I'm coming from a JS background with components like HandsonTable).

As for the .lan DNS requests, I'm curious why they happen to begin with. I've read https://en.wikipedia.org/wiki/.local (there's no page for .lan) but don't understand why any networking code would want to try to resolve microsoft.com.**lan** if resolving microsoft.com failed.

[blaccod]

As for the .lan DNS requests, I'm curious why they happen to begin with. I've read en.wikipedia.org/wiki/.local (there's no page for .lan) but don't understand why any networking code would want to try to resolve microsoft.com.lan if resolving microsoft.com failed.

Well, that's a trick routers do. If you have a machine on your network called server1, the router might offer ability to connect to that machine by typing server1.lan instead of remembering its IP address. To simplify things even further, they might allow typing server1 only, and .lan part is set up as a "search domain". Your OS first tries to resolve server1 through normal DNS means, fails, then appends the search domain at the end and try again.

The process looks like this:

• You: ping server1
• OS: What's the IP address of server1?
• OS: I can't find any.
• OS: I have search domain .lan, what's the IP address of server1.lan?
• Router: I know! It's 192.x.x.x
• OS: okay, ping 192.x.x.x

Now in OpenSnitch situation:

• You: ping microsoft.com
• OS: What's the IP address of microsoft.com?
• Opensnitch: Stop right there, we have a rule that forbids this, I won't let you know about the IP address
• OS: I can't find any (opensnitch blocked that)
• OS: I have search domain .lan, what's the IP address of microsoft.com.lan?
• Opensnitch: I don't have a rule for that, let me create a popup to ask the user for more info

And we came to the situation you observed.

.lan is simply a non-existent TLD that network admins and routers like to use for search domains, because the final result after appending that will never be a valid domain name and therefore never conflict with anything. More info here
.local is a completely different thing that works in completely different ways, but roughly achieves the same end result.

[mixmastamyk]

Yes, I believe that is what is happening.

[gustavo-iniguez-goya]

As for table selection issues - I'm curious how come these low-level bugs exist? Isn't the code using a standard table component that handles all the regular table interactions? (Sorry if this seems naive, I'm coming from a JS background with components like HandsonTable).

Qt handle selections just fine, is our custom view what is bad implemented. We had performance issues when displaying thousands of rows, so I decided to fill just the visible rows. We should rewrite it following the standard practices, and verify that there're no performance issues.

Sound like "Reject" should be prioritized then? Or what is the use case for Deny? If I won't want a connection to happen, I wait it killed, not just have packets dropped - if I understand correctly?

It's explained here:

https://manpages.debian.org/testing/nftables/nft.8.en.html#OVERALL_EVALUATION_OF_THE_RULESET
https://manpages.debian.org/testing/nftables/nft.8.en.html#VERDICT_STATEMENTS
https://manpages.debian.org/testing/nftables/nft.8.en.html#REJECT_STATEMENT

Reject in OpenSnitch differs from the one defined in netfilter. The NFQUEUE subsystem, which is what we use to intercept connections, doesn't support the reject verdict, so instead of sending back an error ICMP packet, we kill the socket of the application.

[mixmastamyk]

I wrote a new bug for the Action issue: #1519

Re: .lan upon further thought, I think what is happening is that my DNS server might be doing a search path kind of thing. Like check X, didn't work, ok try X.lan. My setup is kind of complex, with Adguard and OpenWRT sitting in front of DNS. I removed the local systemd resolver so at least it isn't that one. Will research further when I have time. In the meantime Reject *.lan is working.

[blaccod]

OpenWRT uses dnsmasq under the hood, and have a default config file to advertise .lan as a search domain over DHCP: https://github.com/openwrt/openwrt/blob/main/package/network/services/dnsmasq/files/dhcp.conf

[mixmastamyk]

Thanks for digging that up. Now I need to figure out the ramifications of changing the setting.

[blaccod]

The rule Reject *.lan should be enough, no need to mess with OpenWRT config at all. Maybe also tick "Don't log connections" for that rule so that the connection attempts don't get spammed in the events tab.