How to make OpenSnitch ask each time for certain domains, but otherwise allow everything that isn't explicitly blocked through?

[mariomadproductions]

I'd like to make it so OpenSnitch allows everything through for the chromium process, except domains I explicitly block, but I'd also like it to ask each time for certain google domains (ones which may be used for telemetry but also for user-initiated connections). I've done the first two by allowing all domains as a non-priority rule, and disallowing certain domains as multiple priority rules, but I'm not sure how to do the third thing.

[ghost]

I guess you want something like a host blocker (?).
You can look at certain addresses in "Hosts" tab and then block them in /etc/hosts
I recommend to use hblock (list of addresses) and I also found these domains used for Chrome telemetry:
0.0.0.0 redirector.gvt1.com
0.0.0.0 .r1---sn-25g3oxu-j2ie.gvt1.com
0.0.0.0 ams15s40-in-f14.1e100.net
0.0.0.0 ams15s40-in-f13.1e100.net
0.0.0.0 ams16s31-in-f3.1e100.net
0.0.0.0 fonts.googleapis.com
0.0.0.0 gstaticadssl.l.google.com
0.0.0.0 apis.google.com
0.0.0.0 plus.l.google.com
0.0.0.0 ogs.google.com
0.0.0.0 www3.l.google.com
0.0.0.0 gstatic.com
https://www.unixsheikh.com/articles/choose-your-browser-carefully.html (source)

[gustavo-iniguez-goya]

You can also use OpenSnitch as host blocker :)
https://github.com/evilsocket/opensnitch/wiki/block-lists

[gustavo-iniguez-goya]

Hi @mariomadproductions ,

I don't think it's possible at the moment what you're asking for. The problem is that the rule to allow everything will allow the domains you want to be warned by.

Each rule should have a subsection of "Post-Actions" on connections, like:

When a connection matches this criteria:
1. [ ] Display an alert.
2. [ ] Prompt me to allow or deny it.
3. [ ] Send an email.
4. [ ] Make a post to this url: ...

[mariomadproductions]

I see. For now I will create OpenSnitch rules to block those chromium telemetry domains. Really the main problem is with the domains www.google.com and accounts.google.com which are used by chromium (for telemetry etc), but also used by user-initiated requests.