Is there a way to block Internet access per application on Zorin OS?

General Help
, , , ,
1

Hi,

I am new to Linux and I have a question about controlling Internet access for applications.

On Android, there is an app called AFWall+ that allows you to control which apps can access the Internet. It can also separate different types of network access, for example allowing an app to communicate on the local network while blocking its Internet access.

Is there something similar for Zorin OS/Linux?

I would like to be able to allow or block Internet access for individual applications, rather than blocking specific ports.

For example, I would like to control whether an application can:

  • access the Internet
  • access only my local network
  • have both allowed

I am also wondering if something similar is possible for GNOME extensions.

For example, I installed the "All-in-One Clipboard" GNOME extension and I would like to know if there is any way to control its Internet access.

It does not have to be a firewall specifically. I would just like to know if Linux has a tool or method that allows this kind of per-application control.

Thanks!

2

Welcome to the Forum!

I guess that should be doable with the preinstalled Firewall Program. But I don't know how to do it.

3

I found this sites, but haven't tested them yet:

You can install opensnitch on Zorin 18 with

sudo apt install opensnitch python3-opensnitch-ui
2 Likes
4

I ran a test out of curiosity on my Gnome Machine VM. @Forpli’s command installs version 1.5.8.1-1ubuntu0.24.04.3
If you want the latest .deb version (1.8) available:

Download the packages:

cd ~/Downloads
wget https://github.com/evilsocket/opensnitch/releases/download/v1.8.0/opensnitch_1.8.0-1_amd64.deb
wget https://github.com/evilsocket/opensnitch/releases/download/v1.8.0/python3-opensnitch-ui_1.8.0-1_all.deb

Install the downloaded packages:

sudo apt install ./opensnitch*.deb ./opensnitch-ui*.deb

If any dependency errors occur:

sudo apt --fix-broken install

Activation and Launch:

sudo systemctl enable --now opensnitch

Launch the graphical user interface via the Applications menu

How it works

  • Interactive monitoring: The opensnitchd daemon intercepts every attempt by a programme to connect to the internet and displays a pop-up window alerting the user.
  • Granular control: The user can choose to allow or block the connection for that specific application to the specified destination IP address or domain.
  • Persistent rules: The choices made are saved as rules (temporary or permanent), usually stored in /etc/opensnitchd/rules/, thereby avoiding the need to repeat the process for trusted applications.

My personal recommendation:
Before installation, make a backup (e.g. TimeShift) or test it in a virtual machine environment.

image
image872×636 122 KB

5

Check out my documentation, if you're looking for a firewall that offers complete traffic control, tracker blocking, and secure DNS, Portmaster (open-source for GNU/Linux) might be a good solution.