1.40rc2 not letting through ICMP #455

byReqz · 2021-07-13T15:53:46Z

Hi,

ive been using the -git version from the AUR for ages but since the update to 1.40rc2 yesterday, no pings are getting through.

To Reproduce:
It stops working as soon as you install 1.40rc2 for me. The "stable" 1.3.6 works fine. Also works when the FW is turned off (obviously).

Post error logs:
The log on debug mode does not mention anything about the connections but shows everything else fine. Nping and Ping ICMP probes just time out on local and on remote hosts without any answers.

Expected behavior (optional)
ICMP not being touched by opensnitch.

Screenshots
no errors present

OS (please complete the following information):

OS: Arch Linux
Window Manager: KDE Plasma 5.22.3
Kernel version: 5.12.15-arch1-1
Backend: nftables (iptables-nft, using iptables itself does not change anything)

Additional context
Clean building the Package did not help. /etc/opensnitchd/system-fw.json (which allows ICMP) is present but doesnt seem to be used.

gustavo-iniguez-goya · 2021-07-13T21:00:37Z

Backend: nftables (iptables-nft, using iptables itself does not change anything)

Thank you for the detailed information @byReqz ! It really helps to analyze the problems.

I think that opensnitch is using nftables, which was added recently, but the system-fw rules haven't been adapted to work with nftables yet. Could you verify that you have opensnitch firewall ruless added to nftables? nft list ruleset , the should be two nftables tables (opensnitch-filter for ip and ip6).

byReqz · 2021-07-13T21:03:06Z

Hi, yeah there are opensnitch-filter and opensnitch-magle for IPv4 and 6.

gustavo-iniguez-goya · 2021-07-13T23:18:42Z

ok, unfortunately nftables system-fw.json feature is not ready yet, finished but it needs more work.

This rule should allow ICMP traffic:
nft insert rule opensnitch-mangle output icmp type { echo-request,echo-reply } accept

byReqz · 2021-07-14T12:10:51Z

Thanks for your answer but it doesn't seem to work.

sonsu · 2021-07-16T10:22:04Z

I am having the same issue on
OS: Ubuntu LTS 20.04 Desktop (minimal) install with 1.4.0.rc2
Extra info:
nft command is not installed, tcp/udp works as expected, but ICMP just hangs

x@x-virtual-machine:~$ cat /etc/opensnitchd/system-fw.json 
{
    "SystemRules": [
        {
            "Rule": {
                "Description": "Allow icmp",
                "Table": "mangle",
                "Chain": "OUTPUT",
                "Parameters": "-p icmp",
                "Target": "ACCEPT",
                "TargetParameters": ""
            }
        }
    ]
}

When reverted back to 1.3.6, ICMP works as expected (is allowed through)

gustavo-iniguez-goya · 2021-07-16T15:05:05Z

For now if the firewall in use is nftables and the DefaultAction is deny ICMP will be blocked. I'm making progress to allow to configure nftables system firewall so we can allow it and configure other rules.

In your case @sonsu, what's the output of iptables -V?

pizzadude · 2021-07-19T18:35:01Z

I have the same issue in the latest opensnitch version in Fedora 34. Unless I disable the daemon completely, I can't ping anything.

"nft insert rule opensnitch-mangle output icmp type { echo-request,echo-reply } accept" does not solve the issue, unfortunately.

iptables -V
iptables v1.8.7 (nf_tables)

vukitoso · 2021-07-23T14:55:41Z

debian 10
1.4.0rc2
ping doesn't work

Arjdroid · 2021-07-26T10:23:51Z

Having the same issue here on Arch Linux latest using opensnitch-git from the AUR. I am using iptables-nft.

Output of sudo iptables -V is iptables v1.8.7 (nf_tables)

Output of sudo opensnitchd -version is 1.4.0rc3

All ICMP requests do trigger an alert but even if I click allow the ping response is not there.

Other devices on my LAN are able to ping my IP just fine but my desktop cannot ping any IPs at all (even ::1 or 127.0.0.1 or broadcast IPs like ping 192.168.1.255 -b)

vukitoso · 2021-07-26T11:52:52Z

debian 10
Build from source code (26.07.2021)
1.4.0rc3
ping doesn't work

sudo opensnitchd -version
[2021-07-26 11:52:04]  INF  iptables version: [iptables v1.8.2 (nf_tables)
]
[2021-07-26 11:52:04]  WAR  iptables not available: fw, using nftables instead of iptables ([iptables v1.8.2 (nf_tables)
])
1.4.0rc3

Before this change, we tried to determine what firewall to use based on the version of iptables (if -V legacy -> nftables, otherwise iptables). This caused problems (#455), and as there's no support yet for nftables system firewall rules, it can't be configured to workaround these errors. Now the default firewall to use will be iptables. If it's not available (installed), can't be used or the configuration option is empty/missing, we'll use nftables.

gustavo-iniguez-goya · 2021-08-10T23:25:42Z

I changed how the firewall type to use is determined. By default we'll use iptables, that way we can use system-fw.json to add rules (to allow icmp for example).

If someone needs to use nftables, then they can use "Firewall": "nftables" (default-config.json). nftables' system-fw.json is not ready yet.

molitona · 2021-08-18T18:30:39Z

Thanks for your answer but it doesn't seem to work.

Works, but not persistent. And, here is how I made it persist on Arch too (This is my own solution, many ways discussed with developer before to no avail).

!/bin/bash

IFACE=$1
ACTION=$2

if [[ $ACTION = up ]]; then
if [[ $IFACE = wlp6s0 ]]; then
nft insert rule opensnitch-mangle output icmp type echo-request accept
fi
fi

in

/etc/NetworkManager/dispatcher.d

Then

sudo systemctl restart NetworkManager.service

andryyy · 2021-08-19T17:38:20Z

Still doesn't work for me on a Mint 20.2 with iptables.

My default for iptables is iptables-legacy, if that matters.

When I use nft it fails, too:

[2021-08-19 13:57:46]  WAR  nftables mangle rules not loaded: 0
[2021-08-19 13:57:46]  WAR  Error adding nftables mangle tables:%!(EXTRA *fmt.wrapError=Receive: netlink receive: no such file or directory)
[2021-08-19 13:57:46]  ERR  Error while Running DNS nftables rule: Receive: netlink receive: no such file or directory
[2021-08-19 13:58:16]  WAR  nftables mangle rules not loaded: 0
[2021-08-19 13:58:16]  ERR  Error while Running DNS nftables rule: Receive: netlink receive: no such file or directory
[2021-08-19 13:58:46]  WAR  nftables mangle rules not loaded: 0
[2021-08-19 13:58:46]  ERR  Error while Running DNS nftables rule: Receive: netlink receive: no such file or directory

Probably because of missing tables. I created the mangle table and it only complained about the DNS nftables rule. Is there a default set I should import?

gustavo-iniguez-goya · 2021-08-19T18:53:15Z

Be sure that the item "Firewall": "iptables" exists in /etc/opensnitchd/default-config.json , and restart the daemon (service opensntich restart)

andryyy · 2021-08-19T19:41:20Z

I did and also pulled a fresh copy of that file.

I purge everything and will try again tomorrow. :)

seonwoolee · 2021-08-24T01:38:07Z

I too am having this problem on Arch Linux, using iptables v1.8.7 (legacy) and opensnitch version 1.4.0.rc3. I put "Firewall": "iptables" in /etc/opensnitchd/default-config.json, restarted opensnitchd, and it still doesn't work.

gustavo-iniguez-goya · 2021-08-24T16:27:53Z

hey @seonwoolee , thank you for reporting this.

problem found. Will fix it soon.

andryyy · 2021-08-24T17:36:18Z

In the meantime I forgot to post my test results. They were negative obviously. :)

Thanks for looking into it!

vukitoso · 2021-08-24T20:14:45Z

@molitona

Works, but not persistent.

what is the name of this console client what is on the screen?

molitona · 2021-08-24T20:32:37Z

It's not my screenshot (I replied to an existing comment). BTW, It's a zsh shell custom theme (I guess it's powerlevel10k). Basically, they're shell scripts to customize shell prompt for the awesome ZSH shell.

…

> > Works, but not persistent. > > what is the name of this console client what is on the screen? — You are receiving this because you commented. Reply to this email directly, > view it on GitHub <#455 (comment)>> , or > unsubscribe <https://github.com/notifications/unsubscribe-auth/AIPC4MNPSXS2R2GHMYZPSMTT6P4UDANCNFSM5AJN3L7A>> . Triage notifications on the go with GitHub Mobile for > iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675>> or > Android <https://play.google.com/store/apps/details?id=com.github.android&utm_campaign=notification-email>> .

- The firewall rules defined in /etc/opensnitchd/system-fw.json take precedence over the interception rules, but we were inserting the interception rules before the system's ones. With this change #455 should be fixed. - On the other hand, the DefaultAction was not being applied correctly in all cases. As of today the DefaultAction is applied in 2 scenarios: * When the daemon is connected to the GUI and the user doesn't answer a pop-up. * When the daemon is not connected to the GUI. However as we don't parse all network protocols, even if the GUI is connected we may end up parsing a connection and don't know what to do with it. In this case the DefaultAction was always Deny. Now in the above scenario, i.e.: when the GUI is connected but we can't parse a connection, we'll apply the DefaultAction configured by the user.

gustavo-iniguez-goya · 2021-08-25T11:37:43Z

@molitona @andryyy @seonwoolee could you test latest change to see if the ICMP works again (i.e.: if the rules defined in /etc/opensnitchd/system-fw.json take precedence over the interception ones).

I've also realized that we're denying connections that we can't parse, unconditionally, ignoring what was defined in the configuration.

andryyy · 2021-08-25T19:32:37Z

Is it possible to create deb packages? I would try and compile if not. :) Sorry...

gustavo-iniguez-goya · 2021-08-25T20:19:34Z

Sure, no problem, here you have:
opensnitch_1.4.0~rc4-2_amd64.deb.gz

andryyy · 2021-08-26T04:58:28Z

Can confirm it works. Thanks for providing the package!

gustavo-iniguez-goya · 2021-08-26T13:14:54Z

Thank you @andryyy !

byReqz · 2021-08-26T20:07:38Z

After cleanbuilding 1.40rc4 it seems to work fine now, even without adjusting any config files.

gustavo-iniguez-goya added this to the 1.4.0 milestone Sep 10, 2021

gustavo-iniguez-goya closed this as completed Sep 10, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

1.40rc2 not letting through ICMP #455

1.40rc2 not letting through ICMP #455

byReqz commented Jul 13, 2021

gustavo-iniguez-goya commented Jul 13, 2021

byReqz commented Jul 13, 2021

gustavo-iniguez-goya commented Jul 13, 2021

byReqz commented Jul 14, 2021

sonsu commented Jul 16, 2021

gustavo-iniguez-goya commented Jul 16, 2021

pizzadude commented Jul 19, 2021 •

edited

Loading

vukitoso commented Jul 23, 2021 •

edited

Loading

Arjdroid commented Jul 26, 2021 •

edited

Loading

vukitoso commented Jul 26, 2021

gustavo-iniguez-goya commented Aug 10, 2021

molitona commented Aug 18, 2021

andryyy commented Aug 19, 2021

gustavo-iniguez-goya commented Aug 19, 2021

andryyy commented Aug 19, 2021

seonwoolee commented Aug 24, 2021 •

edited

Loading

gustavo-iniguez-goya commented Aug 24, 2021

andryyy commented Aug 24, 2021

vukitoso commented Aug 24, 2021 •

edited

Loading

molitona commented Aug 24, 2021 via email

gustavo-iniguez-goya commented Aug 25, 2021

andryyy commented Aug 25, 2021

gustavo-iniguez-goya commented Aug 25, 2021

andryyy commented Aug 26, 2021

gustavo-iniguez-goya commented Aug 26, 2021

byReqz commented Aug 26, 2021 •

edited

Loading

1.40rc2 not letting through ICMP #455

1.40rc2 not letting through ICMP #455

Comments

byReqz commented Jul 13, 2021

gustavo-iniguez-goya commented Jul 13, 2021

byReqz commented Jul 13, 2021

gustavo-iniguez-goya commented Jul 13, 2021

byReqz commented Jul 14, 2021

sonsu commented Jul 16, 2021

gustavo-iniguez-goya commented Jul 16, 2021

pizzadude commented Jul 19, 2021 • edited Loading

vukitoso commented Jul 23, 2021 • edited Loading

Arjdroid commented Jul 26, 2021 • edited Loading

vukitoso commented Jul 26, 2021

gustavo-iniguez-goya commented Aug 10, 2021

molitona commented Aug 18, 2021

andryyy commented Aug 19, 2021

gustavo-iniguez-goya commented Aug 19, 2021

andryyy commented Aug 19, 2021

seonwoolee commented Aug 24, 2021 • edited Loading

gustavo-iniguez-goya commented Aug 24, 2021

andryyy commented Aug 24, 2021

vukitoso commented Aug 24, 2021 • edited Loading

molitona commented Aug 24, 2021 via email

gustavo-iniguez-goya commented Aug 25, 2021

andryyy commented Aug 25, 2021

gustavo-iniguez-goya commented Aug 25, 2021

andryyy commented Aug 26, 2021

gustavo-iniguez-goya commented Aug 26, 2021

byReqz commented Aug 26, 2021 • edited Loading

pizzadude commented Jul 19, 2021 •

edited

Loading

vukitoso commented Jul 23, 2021 •

edited

Loading

Arjdroid commented Jul 26, 2021 •

edited

Loading

seonwoolee commented Aug 24, 2021 •

edited

Loading

vukitoso commented Aug 24, 2021 •

edited

Loading

byReqz commented Aug 26, 2021 •

edited

Loading