How to filter OUTPUT chain ala Zonealarm

How to filter OUTPUT chain ala Zonealarm

[Larry Alkoff]

The nice feature of Zonealarm for Windows is it will check outgoing 
packets and ask if you want to allow a specific _program_ to access the web.

In addition, it will warn if a program is asking for server rights.

This would be a nice feature.
Is there any way to do this in Iptables?

If so could you outline how it would be done and I'll play with it on my 
firewall script.

Larry

-- 
Larry Alkoff N2LA - Austin TX
Using Thunderbird on Slackware Linux

RE: How to filter OUTPUT chain ala Zonealarm

[Rob Sterenborg]

> The nice feature of Zonealarm for Windows is it will check
> outgoing packets and ask if you want to allow a specific _program_ to
> access the web. 
> 
> In addition, it will warn if a program is asking for server rights.
> 
> This would be a nice feature.
> Is there any way to do this in Iptables?

Well, something like that. Check the Netfilter website ->
Patch-O-Matic-NG -> Extra repository.
You need the owner patch and the sup-gid patch. It's not really the same
as in Windows (e.g. it won't give you popups) but you can do some owner
matching.

> If so could you outline how it would be done and I'll play
> with it on my firewall script.

See examples. Don't know if it'll fit your needs.


Gr,
Rob

Re: How to filter OUTPUT chain ala Zonealarm

[Taylor, Grant]

Larry Alkoff wrote:
> The nice feature of Zonealarm for Windows is it will check outgoing 
> packets and ask if you want to allow a specific _program_ to access the 
> web.
> 
> In addition, it will warn if a program is asking for server rights.
> 
> This would be a nice feature.
> Is there any way to do this in Iptables?
> 
> If so could you outline how it would be done and I'll play with it on my 
> firewall script.

The only way that I think you could do this in Linux would be to use the QUEUE target and send the traffic to a user space daemon that identified the traffic and communicated with a user.  You may want to take a look at NuFW (http://www.nufw.org)as they do something close to this that might give you a direction to head with it.  (IMHO) I don't think what you are wanting to do will be as useful as Zonealarm on Windows for the simple fact that ZA is running on the system generating the traffic where as most of my IPTables firewalls are running on a central network ingress / egress point where it would be harder to identify which program generated the traffic.  However if you are looking at running this on a Linux notebook or workstation computer you could probably very easily do this.  It depends on what your target system(s) to run this on are.



Grant. . . .