Ubuntu firewall to block/allow applications

Question

I'm looking for a Firewall for Ubuntu to block/allow single applications. I'd like it to have a GUI.

I found Leopard Flower personal firewall for Linux (LPFW) but I need to run sudo ./lpfw and gui/gui.py everytime I access my computer to make it start and works.

It would be nice to have an application like AFWall+ (which is an Android app).

Answer 1

Gufw Firewall looks like it could match your needs:

^{Gufw Firewall (source: ubuntu.com; click image for larger variant)}

I have not tried it out myself, but according to some screenshots it seems to fulfill your requirements:

• Firewall for Ubuntu: Yes
• block/allow single applications: According to the screenshot: Yes (see the "Application" drop-down and, below that, the "Application filter". What makes me doubt this a little is reading between the lines: options for controlling firewall options for common programs and services could also be interpreted like "Selecting Postfix it would block ports 25, 465 and 587 (smtp/smtps/submission) globally for the device". This is not clarified on the page.
• have a GUI: Yes, as the screenshot proves.

There's a list of Linux firewall GUIs, but I'm afraid none of those has the "per application" feature.

Related questions/answers on our sister sites

• Linux per program firewall similar to windows and mac counterparts (SO)
• How to control internet access for each program? (AskUbuntu) – this a.o. mentions Douane which looks like exactly what you're after – but the Douane page currently throws an 503 (check the page in Google Cache meanwhile or rather see their Github presence)

---

As the AU article suggests, Douane seems to match your needs exactly:

When Douane is started, it will watch the ougoing network traffic and as soon as an unknown application tries to send some network packets, Douane will block it and ask you if you allow it or not:

What's left open in the description is whether you can define "exceptions" or make your choices permanent (imagine that popup appearing on each Firefox request) – which I assume can be done in the rules tab of the Douane Configurator:

^{Douane Configurator (source: Douane; click image to enlarge)}

So let's check this one against your requirements:

• Firewall for Ubuntu: Yes (but currently needs to be installed manually, see below)
• block/allow single applications: Yes (see screenshots for prove, also the above linked AU article explicitly says so)
• have a GUI: Yes, as the screenshots prove.

Drawback: Packages are currently only available for ArchLinux, so you'd have to compile and install it manually. Note there's already an open request for Ubuntu packages.

Update: Meanwhile there's a Douane PPA available for Ubuntu.

Answer 2

Being searching for a proper GUI firewall for over 5 years and have been using firestarter, ufw, gufw with variable success. Douane was tricky to compile, and on a recent 64bit ubuntu fails to compile.

Recently ran into Opensnitch which was comparatively easy to install and use on a ubuntu box. It has two processes: a networking process that must be run as root, and a GUI process that runs under the current user.

It is not in standard repos, but the instructions on the github page are pretty straightforward.