block lists

Starting from version 1.4.0rc1, you can block or allow lists of domains.

Since version 1.5.0rc1 you can also use lists of IPs, network ranges and domains with regular expressions.

It can be used to block ads, trackers, malware domains or limit to what domains an application connects to.

How to add a global rule to block malware

Limiting to what domains an application can connect to

Notes

Resources

How to add a global rule to block ads or trackers:

Create a new rule: 000-block-domains
Check [x] Enable, [x] Priority, Duration: always, [x] To this list of domains
Download list of domains of ads to block (choose any directory you wish):

$ mkdir /media/ads-list/
$ wget https://www.github.developerdan.com/hosts/lists/ads-and-tracking-extended.txt -O /media/ads-list/ads-and-tracking-extended.txt

Visit any website, and filter by the name of the rule 000-block-domains . You can use block-test.developerdan.com which is included in the above list.

Limiting to what domains an application can connect to:

We'll create 2 rules:

one for allow connections from an app to a limited number of domains.
another one for deny everything from that app.

Create 2 rules: 000-allow-app , 001-deny-all-from-app
000-allow-app:

Inside /media/app/ write a file with a list of domains the app can connect to in hosts format:

127.0.0.1 xxx.domain.com

Remember that you may need to add the domain without the subdomains (domain.com, xxx.domain.com, etc)

001-deny-all-from-app:

Notes

Lists of domains:

It must be in hosts format:

# this is a comment, it's ignored
# https://www.github.developerdan.com/hosts/
0.0.0.0 www.domain.com
127.0.0.1 www.domain.com

Lists of domains with regular expressions:

one regular expression per line:

# https://raw.githubusercontent.com/mmotti/pihole-regex/master/whitelist.list
adtrack(er|ing)?[0-9]*[_.-]
^analytics?[_.-]
^pixel?[-.]
^stat(s|istics)?[0-9]*[_.-]

Lists of IPs or NETs:

One per line: IPs

# https://iplists.firehol.org/
6.7.8.9
9.8.7.6

Nets:

# https://iplists.firehol.org/
1.0.1.0/24
1.2.3.0/16

Lines started with # are ignored. Write comments always on a new line, not after a domain.
The domains local, localhost, localhost.localdomain and broadcasthost are ignored.
Whenever you save the file to disk, OpenSnitch will reload the list.
OpenSnitch doesn't refresh periodically the list loaded, but you can do it with this script: update_adlists.sh.txt
1. Rename it to .sh and give it execution permissions:
  
  mv update_adlists.sh.txt update_adlists.sh; chmod +x update_adlists.sh
2. Edit the script, and modify the adsDir path to point to the directory where you want to save the lists.
3. Add the script to your user's crontab (in this example, the script will be executed every day at 11am, 17pm and 23pm):
```
$ crontab -e
0 11,17,23 * * * /home/ga/utils/opensnitch/update_adlists.sh
```