// the find
evilsocket/opensnitch
OpenSnitch is a GNU/Linux interactive application firewall inspired by Little Snitch.
OpenSnitch is a Linux application firewall that intercepts outbound connections per-process and prompts you to allow or deny them — the same idea as Little Snitch on macOS. It's for Linux desktop users and sysadmins who want visibility into what processes are phoning home, or who need to enforce outbound policies without a full network firewall. Daemon is Go, UI is Python/Qt.
The dual-backend firewall support (iptables and nftables with a proper expression model) is well-structured — the nftables layer has real test coverage across chains, tables, rules, and expressions, not just smoke tests. The eBPF process monitor is the right call for modern kernels: it avoids the fragile /proc polling that older tools rely on and catches connections much closer to the socket. Multi-node management from a single GUI is a genuine differentiator for the 'I run a few Linux boxes' crowd. SIEM integration and structured log output (JSON, syslog RFC3164/5424, CSV) mean you can feed it into existing tooling without extra glue.
The split between a Go daemon and a Python/Qt UI means two separate dependency chains, two separate install steps, and two separate things that can break — the deb/rpm packages paper over this but if you're not on a supported distro, setup is a headache. The UI communicates with the daemon over gRPC (proto in /proto/ui.proto), which is fine architecturally but means any UI change requires regenerating bindings in both languages. The eBPF modules ship as precompiled blobs for specific kernel versions; if your kernel isn't in the list you fall back to the audit or procmon backend with less accuracy. There's no mention of IPv6 handling in the README and the allowlist files in testdata suggest it's an afterthought, not a first-class citizen.