List with Domains (Regexp) working and not working

[cthulhubuddha]

ubuntu, opensnitch v1.6.0rc3

i am trying to limit the domains the application qemu can connect to. I have an always on rule using the domain regexp list

The domain list file has one entry:
^ntp.ubuntu.com$

The rule's To this port:

Log Level: Debug - the rule matches the regexp and then prompts me with an action popup

It appears my always on rule for this application matches the ntp.ubuntu.com DNS/53 call

But doesn't match the ntp.ubuntu.com NTP/123 call, prompting the popup. When I add the temporary rule for ntp.ubuntu.com those ntp calls show there

Not sure at this point if i'm doing something wrong or if there is a bug, looking for some ideas, thank you

[gustavo-iniguez-goya]

hi @cthulhubuddha ,

First of all upgrade to latest 1.6.0rc5. We've fixed several important bugs since rc3.

Then check [x] Priority rule for the allow rule. That will make opensnitch to allow that rule as soon as it matches a connection. Otherwise it'll continue evaluating rules until a deny rule matches or there're no more rules to evaluate.

[cthulhubuddha]

confirmed. I don't see an update option in the gui, the there a command line equivalent or just install the new .deb?

[gustavo-iniguez-goya]

download the debs from the release page: https://github.com/evilsocket/opensnitch/releases/tag/v1.6.0-rc.5

[cthulhubuddha]

OK, all upgraded (1.6.0rc5) and Priority Rule is selected, same behavior

[gustavo-iniguez-goya]

ok, check only the Regexp list checkbox, and deselect the ports and network ranges checkbox, to be sure that the list is working.

Take a look at this guide: https://github.com/evilsocket/opensnitch/wiki/block-lists#limiting-to-what-domains-an-application-can-connect-to

Also, restrict systemd-resolved to connect only to your DNS nameservers IP, port 53.

By the way, is qemu a flatpak application or is it a system application (non containerized)?
and what process monitor method are you using (Preferences -> Nodes?

[cthulhubuddha]

I removed ports and network ranges, both 53 and 123 hit the base qemu rule (good). I then re-added ports, and both hit the base qemu rule again (good). When I added back the network ranges that's when it duplicated the above behavior - 53 to ntp.ubuntu.com hit the base but does not hit 123 and prompts me if I want to allow it (bad).

I added the actual IPs of ntp.ubuntu.com into the network range list but it still popped a query about ntp.ubuntu.com so it appears there is a conflict with the ranges?

Boxes is flatpak and process monitor is ebpf

[gustavo-iniguez-goya]

I added the actual IPs of ntp.ubuntu.com into the network range list but it still popped a query about ntp.ubuntu.com so it appears there is a conflict with the ranges?

The problem is that in order a rule to match a connection, all the selected fields must match.
In this case, ntp.ubuntu.com is matching the regexp list, but probably the IP is not in the network ranges list.

Sometimes, chronyd, systemd-resolved, or others apps establish a connection against 127.0.0.1:53 or 127.0.0.53:53 (or 1.1.1.1, etc...). If those IPs are not in the network ranges list, then the rule won't match and will continue evaluating rules.

Take a look at the logs, and look for new connection.*

You can also double click on the Hosts tab over the ntp.ubuntu.com, there'll probably be connections to 127.0.0.1 or others DNS server IPs.

For example in my system: