000-allow-localhost.json (wiki)

[akronym0]

I added the "/etc/opensnitchd/rules/000-allow-localhost.json" (copied from the Wiki). And now I see something like this in the event log

Action Allow --- Destination github.com --- Port 53 udp --- firefox.

I am a relative network noob, so please forgive this question :-)

According to the rule, it seems like that Firefox tried to connect to 127.0.0.1:53 udp. Opensnitch allowed that because of the locahost rule. But why does it show the destination github.com in the event log? github.com is not a local address?

[gustavo-iniguez-goya]

But why does it show the destination github.com in the event log? github.com is not a local address?

Because right now we display the domain that an app is trying to resolve, instead of the "IP (DOMAIN)". That's in reality a DNS query to your local stub resolver, to resolve github.com.

Many moons ago we used to display 127.0.0.1 (github.com) -> udp -> 53. That way it was easier (to me at least) to see that it was a DNS query.
Even more clearer when using a remote DNS server: 1.1.1.1 (github.com) -> udp -> 53

But we changed it sometime ago because it was confusing for other users: gustavo-iniguez-goya#6 -> #321 #787

If you right click on a row and select "Details", you'll see all the details of a connection, for example:
UDP 38103:192.168.1.234 -> 1.1.1.1 (telemetry.elastic.co):53

Many times I've found useful to know the source port, or knowing the IP a domain resolved to. But for now we're displaying it in this way.
Maybe we could export the formatting to the Preferences, or have an "advanced view".

[akronym0]

Ok. But there seems to be an odd behavior.

OpenSnitch does not alert when an app tries to connect to an external DNS server. It always allows it when this localhost rule is enabled. Why is that? This is not what I expected. For example this command

dig ExampleDomainWeHaveNeverContactedBefore.com

I would expect to see an OpenSnitch pop-up with deny/allow (because dig is trying to contact an external IP). But there is no pop-up. It seems that OpenSnitch lets apps "leak" the domain to Cloudflare or Google etc (when this localhost rule is enabled). This is not what Firewall users like to see :-)