Application Filtering Software Firewall for Linux? (i.e. Kerio, ZoneAlarm... 4 Linux)

[DrCR]

There are a lot of great application filtering firewalls for windows. Kerio and ZoneAlarmPro (newer ZAfree versions do poorly) come to mind though there are other that are truely excellent like Look'nStop and Jetico.

Are there any application filtering firewalls for Linux? I like to control program access too, not just open and close ports. I'm currently useing GuardDog in KDE, but I consider that just a stopgap until I find something better.

FYI If you're looking for a great firewall-related site, check out www.firewallleaktester.com. All the apps there are WinOS though. Found out about them just recently from <this> eweek article.

Any recommendations?

[techieMoe]

Are you worried about security for yourself or are you wanting to limit access for other users whom you administer?

[DrCR]

Good question. Security just for myself i.e. any other login would have the same access as me.

I like to control what's going outbound. I know I can be a lot less concerned about that when using Linux as opposed to WinOSes, but I liked to have this control in Linux just the same. Been using Linux for a while now and as I said before, just using a port-only firewall, but I would really like the app-filtering (and uneasily spoofed) easily had for WinOSes.

DrCR

[Sagara]

I like to control what's going outbound. I know I can be a lot less concerned about that when using Linux as opposed to WinOSes, but I liked to have this control in Linux just the same.
DrCR

I need this too. Unfortunatelly this thread is empty after a year...

[Sagara]

I'm started learning SELinux and spotted phrase that it can control access not only to files, but even to sockets. I wonder can this be used to allow internet access only for proxy service and to deny internet access to other applications?

Also are there anyone going to develop application filtering firewall for Linux (as it seems not to exist yet)?

[DrCR]

Haven't found anything for Linux yet. Basically gave up trying.

I _love_ Jetico Personal Firewall in WinXP. Really do wish something like this existed for *nixes.

DrCR

____________

[Smither]

Iptables can do this.

From the manpage:

--cmd-owner name
Matches if the packet was created by a process with the given command name. (this option is present only if iptables was compiled under a kernel supporting this feature)

So you can do something like this to block konqueror:

iptables -A OUTPUT -m owner --cmd-owner konqueror -j DROP

[mattydee]

Iptables can do this.

From the manpage:

So you can do something like this to block konqueror:

iptables -A OUTPUT -m owner --cmd-owner konqueror -j DROP

No, seriously though.

I too wish there was a linux firewall that does applicaiton filtering (checksum, hashfile?).

I heard firestarter does this but its for gnome only.