Completely excluding process from monitoring

[Adikso]

I have a problem when using Opensnitch (with eBPF). When I'm running certain apps like game "League of Legends" using wine, the game is crashing upon launch if opensnitch service is running. Pausing does not help, the service has to be completely killed.

Is there a way to somehow exclude a selected process from monitoring? It doesn't work with "proc" method either.

[gustavo-iniguez-goya]

Hi @Adikso ,

If you know the destination port and IP, you can create a firewall rule to exclude it from being intercepted:

[Adikso]

I tried to allow "everything" this way, but unfortunately it still crashes my games

[gustavo-iniguez-goya]

Ok, verify please that the rule has been added: sudo nft list ruleset | grep 2.1.3.7

It should output something like: ip daddr != 2.1.3.7 accept

And maybe instead of NotEqual you need to use Equal? to allow/not intercept traffic to that IP. Otherwise the rule is accepting all outbound traffic except to that IP.

On the other hand, you can set LogLevel to DEBUG under Preferences->Nodes. Run tail -f /var/log/opensnitchd.log and launch LeagueOfLegends. As soon as it crashes, CTRL+C the tail command or copy the log to /tmp

Latest lines of the log could contain what is actually causing the crash. For example: "discarding conn..." or "pid not found..."

[izar3]

Interesting.. I wonder if their anti-tamper is exiting the game after it detects opensnitch or anything monitoring the network?

What does the game log say? or stdout when it quits