OpenSnitch is a free open-source Linux application firewall for people who want a say over which programs reach the internet. It runs on the computer itself, notices when an application opens a new connection, and lets you allow or deny it. A new connection can show a question on screen before it goes through.
Last checked October 28, 2026.
At a glance
- What it is: A Linux application firewall that asks before a program opens a new connection.
- Works on: GNU/Linux, with deb and rpm packages for 64-bit PCs and for ARM boards such as a Raspberry Pi or Librem 5.
- Price: Free to download.
- Licence: GNU General Public License version 3.
- Best for: Linux users who want to allow or block each program’s network access.
- Official site: OpenSnitch on GitHub
What OpenSnitch does (and how it protects your privacy)
OpenSnitch is a GNU/Linux interactive application firewall inspired by Little Snitch.1 A router firewall mostly worries about strangers coming in. OpenSnitch worries about programs on your own machine going out. When one of them starts a new connection, the window can ask what you want to do. If you do not answer, it waits 30 seconds, then applies the default action that is configured.5
Allowing one program does not allow the next one it launches. Any other program it starts is stopped until you allow or deny that one too.6
OpenSnitch does not encrypt traffic, and it does not change what your internet provider can still see. Its job is the choice on the computer: which programs may speak at all. The latest release is version 1.8.0, published on 15 December 2025 (UTC).9 The release notes record a window package update dated 15 June 2026.3
Key features of OpenSnitch
- Questions for new outgoing connections. The window lists the connections and processes it has intercepted, and you allow or deny each one.5
- Rules you can keep. You can save a permanent rule, with duration “always”, for a process, an address, or a host.5
- Block lists for the whole computer. You can block ads, trackers, or malware domains system-wide.7
- A system firewall page. From the same window you can configure the system firewall with nftables.1 You can set the inbound policy and allow particular services.1
- More than one computer. A single window can manage several machines, if you choose to connect them.1
- A record of which program connected. Since version 1.4.0 the usual method is eBPF, a small program inside the Linux kernel that reports which process opened the connection.8
Pros and cons
Pros
- An unexpected connection shows up as a question, and the window shows the process that opened it.5
- Rules live on the computer, under
/etc/opensnitchd/rules/.4 The window’s settings stay in your home folder.4 - Tracker and ad domains can be blocked for every program, not only inside the browser.7
- The source is published under the GNU GPL version 3.2
- Packages cover 64-bit PCs and ARM boards, including a Raspberry Pi and the Librem 5.3
Cons
- The project says OpenSnitch does not refresh a loaded domain list on its own, and it points to a script if you want to update the list.7
- The first hours bring many questions. The project says that once your usual programs have rules, you barely notice it running.6
- With the window closed, the service uses the action in its config file, which the project describes as Allow.4 The window’s default, Deny, applies only while the window is connected.4
- The version 1.8.0 window does not run, as shipped, on Ubuntu 22.04 or earlier, Linux Mint 21.2 or earlier, or openSUSE 15.5 or earlier.3
- Domain block lists may not match when the computer uses systemd-resolved to look up names.7
- On some Linux 6.17 kernels the project reports that it cannot create certain system firewall actions, such as reject, log, or quota.3
Is OpenSnitch safe and private?
By default the window listens on a local socket, /tmp/osui.sock, so the service and the window talk on that computer.4 Rules reload from /etc/opensnitchd/rules/ when they change.4 The window saves its choices in $HOME/.config/opensnitch/settings.conf.4 The service is set up to write a log at /var/log/opensnitchd.log.4
While the window is connected, it applies the action chosen there, and that default is Deny, so an unanswered connection is blocked.4 When the window is not connected, the service follows /etc/opensnitchd/default-config.json.4 The project calls that shipped action Default Allow.4 Opening the window does not rewrite the file.4 If you set the service’s own action to deny, you also need a rule that allows localhost traffic.4 You can point the service at a window on another computer.4 Use that only for a computer you trust.
The project says eBPF intercepts programs faster, and in a more secure way, than reading the process list, which it says is easier to fool.8 The project says XanMod and Liquorix kernels are compiled without the features eBPF needs, so on those kernels OpenSnitch uses the process list (ProcFS).6 The command opensnitchd -check-requirements reports whether the kernel is suitable.6 New connections it handles are TCP, UDP, UDPLITE, SCTP, and ICMP.6 The licence file is the GNU General Public License version 3.2
How to get started with OpenSnitch
- Open the releases page and download both the daemon (the background service) and the GUI (the window).3 Use the x86_64 build on a 64-bit PC, or arm64 or armhf on a Raspberry Pi or Librem 5.3 If the 1.8.0 window will not run on an older desktop such as Ubuntu 22.04, the notes say the 1.8.0 service can still work with the 1.7.2 window.3
- Install both files. On a Debian-style system the command is
sudo apt install ./opensnitch*.deb ./python3-opensnitch-ui*.deb.1 On an RPM system it issudo dnf install opensnitch*.rpm.1 - If the service does not start by itself, enable it with
sudo systemctl enable --now opensnitch.service.3 - Start the window with
opensnitch-ui, or from the menu entry named OpenSnitch.1 An empty status area means the daemon package may be missing, not only the window.5 An unanswered question applies the default action after 30 seconds.5 - For a quieter first day, set the pop-up action to Allow and, if you like, turn pop-ups off.5 Switch it back to Deny.5 Save rules that block by default and allow only the processes or connections you want.5
- If a pop-up crashes when you click it on a Wayland desktop, open Preferences and, on the UI tab, set the Qt platform plugin to xcb.3
Who should use OpenSnitch (and who might prefer something else)
OpenSnitch fits someone who already uses Linux and wants to review outgoing connections. It suits a desktop where software comes from more than one place, and you would rather be asked than find a connection later.
On Windows, simplewall sets application connection rules. On a Mac, LuLu reviews outgoing connections. On Android, NetGuard chooses which apps get internet access.
Frequently asked questions
Is OpenSnitch free?
Yes. You download the daemon and the window from the project’s releases page.3 The source is covered by the GNU General Public License version 3.2
Does OpenSnitch work on Windows, iPhone, or Android?
The releases page offers deb and rpm builds for GNU/Linux.3 Those are Linux packages, so this is not the tool for a Windows PC, an iPhone, or an Android phone.
Is OpenSnitch safe?
It is a local filter with published source. It does not encrypt traffic. Keep the window running if you want its Deny default. Ignored questions use that default after 30 seconds.5 The questions ease off once your rules are saved.6
Can OpenSnitch block ads and trackers?
Yes. From version 1.4.0rc1 you can block or allow lists of domains.7 Since version 1.5.0rc1 you can also use lists of IP addresses, network ranges, and domains with regular expressions.7 This may not work if systemd-resolved is looking up names.7 The guide says to allow that service to talk only to the DNS servers you chose.7
