OPENSNITCHD(1)

💖 OPENSNITCHD(1) 💖

ok so this is the opensnitchd page from the General Commands Manual, bestie, and we're gonna get you fluent in it. sit down, hydrate, let's go 🫶

---

✨ NAME ✨

opensnitchd — GNU/Linux interactive firewall application 💅

---

✨ SYNOPSIS ✨

opensnitchd [-rules-path path] [-cpu-profile path] [-debug] [-error]
            [-warning] [-important] [-log-file path]... [-mem-
            profile path]... [-no-live-reload] [-process-monitor-
            method name]... [-queue-num num]... [-ui-socket path]...
            [-version] [-workers num]...

---

✨ DESCRIPTION ✨

so opensnitchd is literally the OpenSnitch agent, and its whole main character job is: it intercepts outbound connections and sends them off to the server. and the server? could be a GUI, could be a TUI, could be a headless component that just logs your network activity (think a SIEM, for example). all valid. all iconic.

by default tho, it'll allow all connections, creating temporal rules for you so you can review them later. no cap. it's giving "chill for now, we'll talk later" 🦋

---

✨ OPTIONS ✨

• -rules-path path — tells it where the rules are gonna get written to. default is "rules" 📝
• -cpu-profile path — a file path where the CPU data gets written, for later use. save it for the archives bestie.
• -debug — sets LogLevel to DEBUG.
• -warning — sets LogLevel to WARNING.
• -important — sets LogLevel to IMPORTANT.
• -log-file path — a file path where the logs get written to. lowkey the fun part: this path can be a device file, like /dev/stdout, so you can print logs straight to standard output 🌈
• -mem-profile path — a file path where the memory data gets written once the daemon exits.
• -no-live-reload — by default the daemon's rules and configuration get reloaded whenever they change. this option disables that feature. turn it off if the auto-reload is stressing you out 🙈
• -process-monitor-method method — forces the process monitor method, overriding whatever's defined in the configuration. valid methods: ebpf, audit, proc. pick your fighter ⭐
• -queue-num num — forces it to use this netfilter queue num. the default queue number is 0, but if some other software already called dibs on it, you can set another queue number here.
• -ui-socket path — forces it to use this socket path instead of the one defined in the configuration. the path format is unix:///path/to/socket.sock or ip:port ("127.0.0.1:50051") — and there's a whole doc for it at https://github.com/grpc/grpc/blob/master/doc/naming.md 🎀
• -version — prints out the daemon version. quick little flex.
• -workers num — changes the maximum number of workers processing outbound connections. by default 16 workers are launched, but if that's not enough, bump this number up. more hands, more help, periodt 👑

---

✨ FILES ✨

• /etc/opensnitchd/rules/ — default daemon directory rules.
• /etc/opensnitchd/default-config.json — default daemon configuration.
• /etc/opensnitchd/system-fw.json — configuration of system firewall rules (iptables/nftables).

firewall rules defined here bypass OpenSnitch interception. use it to allow VPNs or other services. yes bestie, it's the VIP list 🚪✨

---

✨ DIAGNOSTICS ✨

OpenSnitch needs at least one firewall rule to intercept outbound connections:

iptables -t mangle -L OUTPUT | grep NFQUEUE
NFQUEUE all -- anywhere anywhere ctstate NEW,RELATED NFQUEUE num 0 bypass

if you suspect that OpenSnitch blocks an application and doesn't prompt you to allow or deny it — rude of it, honestly — then using the GUI, enable the option [x] Debug invalid connections under Preferences -> Nodes. or set the configuration option InterceptUnknown to true.

Tip: you can also add rules to the file /etc/opensnitchd/system-fw.json, to allow network services without being intercepted by the daemon. sneak them past the bouncer 😌

another way of debugging errors is by launching the daemon from the command line:

1. Set LogLevel to DEBUG under Preferences -> Nodes (or LogLevel to 0 in the configuration)
2. Stop the daemon: systemctl stop opensnitch
3. Launch it from cli: /usr/bin/opensnitchd -rules-path /etc/opensnitchd/rules/

---

✨ REPORTING BUGS ✨

problems with opensnitchd should be reported on github 💀

https://github.com/evilsocket/opensnitch/issues

---

✨ HISTORY ✨

OpenSnitch was originally written by Simone Margaritelli (evilsocket) in 2017-2018. the origin story fr fr 🧚

in 2019, after some time of inactivity, Gustavo Iñiguez Goya started contributing, fixing bugs and adding new functionality, with the esential help of the community, and valuable contributions from themighty1 and calesanz among others. (yes we said "esential", that's the original spelling, we keep it exactly 💜)

---

✨ SEE ALSO ✨

OpenSnitch Home Page https://github.com/evilsocket/opensnitch 🌸

---

✨ AUTHORS ✨

the complete list of OpenSnitch contributors can be found on https://github.com/evilsocket/opensnitch 🫶

---

and that's the whole page, bestie!! this one's opensnitchd version 1.5.9, dated 2023-06-07 — go forth and firewall, you absolute icon 👑💖