Portmaster 1.0 – Open-Source Network Monitor and Privacy Firewall
safing.io
safing.io
We're on a mission to bring privacy back to the masses. Privacy has to be easy & accessible for everyone, while hackers and tinkerers should have the tools to customize everything to their needs. So while Portmaster 1.0 is a big milestone, this is just the start!
[1]: https://news.ycombinator.com/item?id=29761978 [2]: https://star-history.com/#safing/portmaster&Date
(1) Are you planning on having support for more than 5 devices at a future point?
(2) Will you have any features to support parents protection of their children?
(3) How easy is it to integrate Safing into a home security stack, or an enterprise security stack?
(4) Have you considered a one-time unlimited buy-in level in lieu of monthly?
(5) Is this coming for iOS & MacOS?
Thanks for pushing the privacy front.
(1) Are you planning on having support for more than 5 devices at a future point?
5 devices is what we estimate 1 user has (avg max). If there is demand, we will definitely add a plan to support more devices (or users).
(2) Will you have any features to support parents protection of their children?
We already collect NSFW filter lists to be activated in the settings. Otherwise such features are tricky, as we need to start protecting against the person in front of the device, which is very hard. If you have suggestions, please share!
(3) How easy is it to integrate Safing into a home security stack, or an enterprise security stack?
Can you elaborate on what exactly you have in mind? We don't offer any integrations with other system out of the box yet. We have APIs though that you can use.
(4) Have you considered a one-time unlimited buy-in level in lieu of monthly?
We had a couple lifetime plans on our Kickstarter (years ago). Right now, we don't have any plans for this. You can pay in advance though - up to 4 years.
(5) Is this coming for iOS & MacOS?
Yes. Or, at least we will attempt. Going to be "fun" if Apple continues their locking down strategy. Maybe the EU will force them to open up until then. Expect at least 1-2 years for this to land though.
> ... we need to start protecting against the person in front of the device
But then I thought of the other common reason this kind of capability is added to software -- are you preparing for the eventual future where you will have to do this, not to protect from a child removing the software, but to protect from another app surreptitiously removing Portmaster in order to bypass its protections?
Well, the first thing we might do is just a "Only an Administrator can make changes." setting where you only admin accounts are allowed to change settings. This one makes sense. Everything beyond that gets complicated and easy to circumvent fast.
(I also think the original question was more about blocking features and the likes.)
Protecting against other software is related, but also different. We have some decent protection here, albeit not against simply shutting Portmaster down.
>5 devices is what we estimate 1 user has (avg max). If there is demand, we will definitely add a plan to support more devices (or users).
I'd estimate for a family plan (my case) we'd have 5 users. Given that I am on HN and part of the technocrati collective we have a ton of devices, particularly once your iOS & Mac OS coverage kicks in too.
>(2) Will you have any features to support parents protection of their children?
>We already collect NSFW filter lists to be activated in the settings. Otherwise such features are tricky, as we need to start protecting against the person in front of the device, which is very hard. If you have suggestions, please share!
I think it would be person in front of the device, but a NSFW filter list is the min requirement, sounds like you already meet that.
>(3) How easy is it to integrate Safing into a home security stack, or an enterprise security stack?
>Can you elaborate on what exactly you have in mind? We don't offer any integrations with other system out of the box yet. We have APIs though that you can use.
Aggregating logs across all devices protected. I don't know if syslog would be best, as there are options
Unified console for centralized control of all instances would be a stretch goal
Shopping logs is easy technically, but what to put in there? Just mirror the logs from the local instance or just limit it to connections? Which format, what data?
We recently switched to an in-mem SQLite database for querying connections. In the future, we'd like to send the rows to a central instance of the user, with a UI for querying everything at once.
Also, creating setting templates for apps and enforcing certain settings on many devices is something that seems useful.
Note: This is all quite far out.
1. Does Safing own and operate all the exit nodes or can folks add their own nodes to it?
2. Are you self-hosting the exit nodes? If not, I'm curious what cloud providers you use.
3. Have you found egressing through a bunch of different geolocated IPs for the same request triggers DDoS/anti-scraping systems (like Cloudflare) more than usual?
1. Does Safing own and operate all the exit nodes or can folks add their own nodes to it?
Everyone can join. We also plan to compensate in some way in the future. Docs: https://docs.safing.io/spn/hosting-a-community-node
2. Are you self-hosting the exit nodes? If not, I'm curious what cloud providers you use.
We rent servers. If you have the SPN, you can click on every server on the map and check where it is hosted. Currently mainly Hetzner, OVH, Katamera, HostHatch. We regularly try new providers, rent a couple servers and see how it goes.
3. Have you found egressing through a bunch of different geolocated IPs for the same request triggers DDoS/anti-scraping systems (like Cloudflare) more than usual?
The client "pins" destination domains/IPs to an exit for an hour (scoped per app) in order to get more stability here. We had issues in the past.
Just one question: In the past, postmaster had problems with WSL2.
I documented the issue and the solution: https://www.reddit.com/r/safing/comments/ryioj7/portmaster_b...
Is it fixed now?
Just add a PowerShell script at install time to exempt the virtual network interfaces from Windows Firewall if WSL is detected and the user agrees! It's super simple and easy.
Currently running in an electron instance, with the plan to switch (back) to a webview provided by the OS.
UI is served by the background process, so you can also open it in the browser at 127.0.0.1:817 - if you have development mode enabled.
I didn't found any guides regarding building from source. How can I build the app/installer by myself?
The thing is that Portmaster consists of a lot of components[0]. I don't think we'll get around creating a docker image that does all the steps automatically - as far as possible. For Windows this will be infeasible for most, as you need a EV Code Signing Cert (300$+) for signing the kernel extension.
Can you elaborate on your use case?
[0] https://docs.safing.io/portmaster/architecture/update-system...
Since Portmaster is open-source, I expected that I can modify and compile the software by myself. Maybe I will hack around when I have time.
Is compiling locally not possible without the signing cert?
Most repos have a "./pack" script that correctly builds all assets. You can then place them as "v0.0.0" (as _v0-0-0) in the updates directory. If you put Portmaster into dev mode (--devmode) it will load the v0.0.0 versions first. You might want to also disable automatic updates - or ignore the automatically downloaded versions.
Compiling for Windows without a cert works, but the OS will refuse to load the driver. You'd need to switch to a special Windows developer mode and sign it with a local certificate.
As I said, this is an area where we need to improve.
Windows 10+11 full. Windows 7+8 without desktop notifications.
Q: Also what happens with the firewall that ships with Windows when you install Safing?
Currently nothing. It stays there and active as it is.
Would you recommend to manually disable the Windows firewall?
It seems obvious that VPN services should be split into Relay and Exit services so that you don't have to necessarily trust a single company not to collect and sell all your internet traffic.
It would be interesting to see where SPN goes, and more on how it works, as you say.
Yes, you are correct, there are similarities there. Except of course that SPN is open source.
We do have a white paper: https://safing.io/files/whitepaper/Gate17.pdf
And YES! I'd love to see more technical discussion of the SPN too. So many things to unpack, to learn and improve.
The website seems to be very light on any technical details, doesn't give me a slightest idea how it operates. Looking at the comments here I suspect it's a endpoint firewall using a VPN (SPN) to tunnel all the traffic through a virtualized network interface and apply rules and analytics to it.
It integrates with nfqueue on Linux and a kernel extension on Windows. It does not use a virtual interface.
The SPN (Safing Privacy Network; VPN alternative) is optional.
More details on the docs: https://docs.safing.io/
I have a VPN configured in my pfSense router so that I don't need to run it in each client. I guess this would make it easy to go over the 5 device limit though...
Regardless, I'll try out for the firewall and network monitoring.
The device limit is hard, but we need to limit usage somewhere, as we don't see how much bandwidth one user uses.
Can you elaborate on your use case where you have more than 5 devices?
My only problem with it is that under heavy load the DoH server dies or gets stuck at 50% CPU for me. It also hangs my custom DoT/DoH solution for some reason but that's not a Portmaster problem.
About your DNS issues: Have you opened an issue on GitHub yet?
I'll try to remember to collect the logs next time it happens so I can open a useful issue.
While it happens, simply go to the "Get Help" page in Portmaster and click on "Report Bug". It will collect some debug info and you can create an issue directly on GitHub from there.
The only major problem I hit was that everytime a snap would update it would appear as a new application and I had to reapply the rules. At the time there was a proposal for a change to fix this but it hadn't been implemented yet. I think once that lands, if it hasn't already, I'll be a loyal daily user.
EDIT: Adding GitHub issue link https://github.com/safing/portmaster/issues/398
That's a confusing statement... does this mean they change your DNS server/provider by default, if you are using a VPN?
[1] https://docs.safing.io/portmaster/install/status/vpn-compati...
https://security.stackexchange.com/questions/42752/how-does-...
Portmaster overrides any custom DNS server and enforces the ones the user set - or are set by default. This "breaks" the VPN leak test.
You'd need to use a leak test from the DNS provider for it to work.
Thanks for the feedback. I will look into improving the text.
If Portmaster "enforces DNS servers with the ones that are set", after installing Portmaster and without the user changing anything, i'd say that's a decrease of privacy;
Your VPN provider can see your traffic in any case (even when you're not using their DNS server.) So, if Portmaster would change this to whatever your default is (Cloudflare, Google, etc.), people are then suddenly sharing their DNS requests with yet another 3th party.
But especially with a VPN the privacy is increased as it effectively becomes DNS-over-TLS/HTTPS-over-VPN. The VPN still sees your destination IP addresses, so the privacy improvement is not increased by a lot, but still.
Ah right, that sounds good. So the user is aware of it.
> But especially with a VPN the privacy is increased as it effectively becomes DNS-over-TLS/HTTPS-over-VPN.
I disagree; VPN providers use an internal IP as DNS server and your connection to this DNS server goes through a secured VPN tunnel anyway.
So, by sharing your DNS requests with an external 3th party you gain nothing, and it's even a decrease of your privacy since now Google/Cloudflare/etc collects all these requests.
DNS Configuration Guide: https://docs.safing.io/portmaster/guides/dns-configuration
The problem was that there isn't a "keep my DNS as is" option in the initial setup dialog (or not an obvious one), so we are forced to pick one from the four secure DNS.
Pretty cool that both Windows and Linux both are supported and already exist. Keep up the good work!
I also appreciate the easy to read and clear privacy policy about what telemetry and data this SaSS platform collects and how it is handled.
https://safing.io/privacy/#article-1-where-we-collect-datapi...
Don’t you want to be the customer rather than the product?
The reason I'm open to paying a monthly fee for a SaSS offering is to keep getting new features and timely security updates, and support ensuring the recurring expense aspects of the service can stay alive. It's not entirely clear to me yet why PortMaster needs to be a SaSS, but it's not implausible.
I don't have any Windows or Linux desktop machines in regular use currently, looking forward to trying this out once the Mac version exists.
To clarify, I'm absolutely not subscription shaming, and I understand that startups are effectively forced to use a SaaS model in order to attract investors.
I personally consider that a "pro". You may not have experienced subscription fatigue yet, which is great.
> Don’t you want to be the customer rather than the product?
You may have misunderstood — Little Snitch is a paid product that collects no data.
Edit: Shipping such a component enabled by default might be unexpected for applications of this nature and easily overlooked, which is why I mention it.
[1]: https://docs.safing.io/portmaster/install/status/mac
EDIT: Added link to source
Does Portmaster still require a local DNS server? I’ve been an avid user of Glasswire for years and it works flawlessly with my VPN. But i would love to switch to a open source alternative.
GlassWire will probably become quite blind as soon as TLS1.3 is rolled out and working as intended.
I will look into Mullvad compatibility again in the coming weeks. I think they also improved some stuff on their side.
User from 2 weeks ago: "Can confirm that Portmaster V.1.0.0 with Mullvard V2022.4 DNS set to 127.0.0.1 and the same setting on the netwerk controller both can life together." from https://github.com/safing/portmaster/issues/313
Still, I can run it on my main machine.
The networking looks a great blend of onion routing and secured connections. Really clever way of constantly changing a client IP. As someone else noted it's like a client/outgoing version of Cloudfare's DDoS mitigated network design.
I've been looking at Portmaster for a while- it seems to be a valid option for those of us who dabble with the idea of totally halting the telemetry despite it being designed to be hard to stop
Linux install options: https://docs.safing.io/portmaster/install/linux
* How does SPN differ from a VPN, in detail? In other comments you said that it's similar to Tor, but what does that actually mean?
* Does traffic get routed through multiple nodes before being routed to the destination? If not, what sets it apart from a VPN - apart from being able to choose different servers for every program on your PC?
* Is SPN intended to provide privacy against nation-state actors where simply masking your exit node is not sufficient, similar to what Tor claims to do?
* Who operates exit nodes (and any intermediary nodes in the SPN network), are they owned or rented dedicated servers, and does it include residential connections - to provide unblocking for streaming services?
* Is traffic routed through other Portmaster users' internet connections?
If you haven't read these post [0][1] already, please do so and come back with any remaining questions!
[0] https://safing.io/blog/2022/09/06/spn-vs-vpns/
[1] https://safing.io/blog/2020/01/22/how-the-spn-compares-to-to...
Q: Does traffic get routed through multiple nodes before being routed to the destination? If not, what sets it apart from a VPN - apart from being able to choose different servers for every program on your PC?
Yes. And you can configure how much of that you want - per App: https://docs.safing.io/portmaster/settings#spn/routingAlgori...
Q: Is SPN intended to provide privacy against nation-state actors where simply masking your exit node is not sufficient, similar to what Tor claims to do?
"Nation-state actor" is a bit vague, assuming the most common meaning (IMO): a global passive adversary.
Quoting from the Tor design document: A global passive adversary is the most commonly assumed threat when analyzing theoretical anonymity designs. But like all practical low-latency systems, Tor does not protect against such a strong adversary.
Neither Tor, or the SPN (or anything else) will protect you from this. If they can really see everything, they will find you - sooner or later.
What we aim for is to stop exposing you to the data sources of the mass surveillance dragnet: Online tracking and the Internet-network itself.
Q: Who operates exit nodes (and any intermediary nodes in the SPN network), are they owned or rented dedicated servers, and does it include residential connections - to provide unblocking for streaming services?
Currently we rent servers, but will start adding our own dedicated ones once the scale is there. Nodes are also hosted by the community to diversify the node ownership in order to strengthen the privacy protection. Currently not using residential connections.
Q: Is traffic routed through other Portmaster users' internet connections?
No.
For privacy, you never want to be the only person using a server.
Also what would happen if I installed a Windows gateway, using routing and remote access services, and then installed portmaster on that?
Overall this looks pretty awesome, and I'm excited to try it out.
Oh and can I use this in conjunction with wire guard? How does it play with other vpns.
Basically negligible. Secure DNS might be a bit slower and you might feel some impact on low end devices.
Q: Also what would happen if I installed a Windows gateway, using routing and remote access services, and then installed portmaster on that?
You'd probably be cut off as incoming connections are blocked by default. Please place a config with exceptions before install or have (virtual) physical access when installing.
Q: Oh and can I use this in conjunction with wire guard? How does it play with other vpns.
We have a whole page on that in the docs: https://docs.safing.io/portmaster/install/status/vpn-compati...
First request would be a way to sync settings across multiple machines, or at least a way to import/export configs.
I did get hit with the issue about having incoming connections blocked by default - realized RDP connections were blocked even from the local subnet, and had to go plug a physical monitor in.
I was a bit surprised I couldn't figure out a clean way to allow inbound connections from the local network, but not from the internet. The docs at https://docs.safing.io/portmaster/settings seem to imply that I can set various settings to different tiers - 7 for trusted, for untrusted, 4 for hacked, but even when I have the developer view tuned on, I just see a binary choice.
Check out this page on the docs: https://docs.safing.io/portmaster/guides/network-rating
> sync settings across multiple machines
planned, but long-term goal.
> import/export configs
planned, short-term goal.
[0] https://docs.safing.io/portmaster/settings#filter/dnsQueryIn...
[1] https://docs.safing.io/portmaster/guides/dns-configuration
I have followed multiple links, never able to find the expansion of the acronym. So weird.
"This was originally invented for Tor and is called Onion Routing. This way, every server in the chain only knows the previous and the next hop. No server ever knows who you are AND where you are going to."
"As VPNs are centralized, all their servers are operated by only one entity - the VPN provider itself. They can, therefore, monitor all you traffic and see what you are up to. This is why they tout their “No Logging” policies so loudly, because they know they can see everything."
"SPN on the other hand invites the community to join the network and strengthen it by adding diversity to the operators of the network. This way - in addition to the cryptographic protections - it is made almost impossible that anyone will ever be able to track you through the SPN."
It sounds like it is a next-gen VPN service which addresses the shortcomings of the current VPN services by splitting the service into relays and exits, each with limited knowledge and each potentially operated by different parties.
Came back to answer the question and you beat me to it! Thanks!
SPN (Safing Privacy Network) aims to fill the area between VPNs and Tor. VPNs provide very little real privacy and Tor is (outside Tor Browser) very difficult to setup and configure.
With the combination with the Portmaster (which is also firewall), we provide superior privacy to any VPN and offer a 1-click install for a software that you cannot mis-configure.
If you have any questions, please ask!
Except of course for the SPN, which has a growing network of servers to relay traffic.
0 - https://www.freebsd.org/cgi/man.cgi?query=portmaster&sektion...
https://archive.org/details/h42_Livingston_Enterprises_PortM...
choosing the same name as a revered network router (the first one really affordable by mere mortals) may alienate some old timers
The Linux distribution was probably Slackware. Kernel was probably early 2.x?
Fun times...
The folks I interview these days with their new fenagled CS degrees have no clue how anything works. They can write code, sure, barely, but they can't answer a single question about how _any_ of it works.
How do you get a CS degree and not know the difference between TCP and UDP?
How do you become a front-end developer who codes React apps but can't explain the DOM? Have no clue what a conditional GET is?
It makes me sad...
- terminates one 1E line (30 B-channels)
- provides ISDN dial-up on those channels
- provides DSP based modems in case analog modem calls should be handled
This was a key component of being an ISP in early days.
https://osmocom.org/projects/retronetworking/wiki/Livingston...
SIP channels -> voice card -> out a T1 (network) -> in another T1 (CPE) -> to DSP modem.
(Or dialout, DSP modem -> out a T1 (CPE) -> in a T1 (network) -> voice card -> SIP.
It just -doesn't quite- work. I can get 14400 no problem, but V.90 doesn't seem to entrain. Still troubleshooting (could be undesirable jitter buffer settings on my ISP side).
I just barely missed end-of-sales of ISDN BRI in my area which could have been useful for get to the PSTN at high quality.