How to install a firewall like uwf on the Steam Deck?

[L.Brown]

Like on my PC desktop I would like to install a firewall on the Steam deck, for example to remove internet access from games that do not need it.

In the Steam Deck desktop settings it says that no firewall is installed and you have to install ufw first, for example. Unfortunately this is not found in the package manager.

Can someone tell me how to install this (or any other "good") firewall, along with a GUI like Gufw? I have already set a password for the Steam Deck. However, I have read that own program installations via the terminal are probably stored by default only in a read-only directory and therefore may only work temporarily?

Thank you really, really much for any help!

[my new friend]

Originally posted by L.Brown:

for example to remove internet access from games that do not need it.

May I ask why not use offline mode instead? Why do you need to remove access to the internet for games that may require it?
I'm only curious.

[L.Brown]

Originally posted by my new friend:

Originally posted by L.Brown:

for example to remove internet access from games that do not need it.

May I ask why not use offline mode instead? Why do you need to remove access to the internet for games that may require it?
I'm only curious.

In offline mode I don't have access to any steam functions like guides, discussions or achievements.

And nearly all of the singleplayer games I played on my PC don't require internet, but my firewall tells me they want it, for reasons I don't (want to) know. (Probably mainly because of analysis tools of some game engines, automatic crash messages ect. The thing I don't like is that the games don't ask if they are allowed to do that and just do it, and I don't know which data are transmitted.)

[my new friend]

Most of them are using Steam Cloud for saves and quite a few use the SteamDRM itself to validate ownership.

[L.Brown]

Originally posted by my new friend:

Most of them are using Steam Cloud for saves and quite a few use the SteamDRM itself to validate ownership.

But then isn't it enough for Steam to have internet access alone? The game saves, for example, are managed by Steam and uploaded to the cloud, and the removal of the Internet for the game should have no effect then, because Steam itself still has access to the internet? Also this should not have any effect on the SteamDRM, too.

Like I said, on my PC every (singleplayer) game I tried works without internet access.

EDIT: And there the cloud saves are working, too.

[retrogunner]

If Steam OS/Deck lacks these by the time I get to order mine, I'll be putting them into the Feature Request sub-forum :
* ufw with a gufw-like game/desktop UI. At least have ufw and let the community implement the UI via the Community Steam OS Plugin Manager.

* bake in VPN options such as Wireguard/OpenVPN. If Valve doesn't, I'll have to look into SSH port tunneling with a UI via the Community Steam OS Plugin Manager (or a similar option.)

Considering every modern OS (Android to PC OS's - even cheap home routers - have these already, Steam OS should too.

[L.Brown]

Originally posted by retrogunner:

If Steam OS/Deck lacks these by the time I get to order mine, I'll be putting them into the Feature Request sub-forum :
* uwf with a guwf-like game/desktop UI. At least have uwf and let the community implement the UI via the Community Steam OS Plugin Manager.

Oh, I can do that, too? The search in the sub-forum shows that no such (firewall-)request exists already.

[Marlock]

you can always use Pi-Hole or similar intermediary device to enact some network rules if the Deck doesn't support VPN/firewalling directly

i never used this myself, but afaik linux firewalls can't block by application, only by IP and port range rules... so you probably won't hit any extra limitations by routing all your PC traffic through this local network solution

[Ghett Klapson]

Originally posted by Marlock:

you can always use Pi-Hole or similar intermediary device to enact some network rules if the Deck doesn't support VPN/firewalling directly

i never used this myself, but afaik linux firewalls can't block by application, only by IP and port range rules... so you probably won't hit any extra limitations by routing all your PC traffic through this local network solution

Some examples that exist that do this: Safing Portmaster and opensnitch. The former is in alpha but has an AUR package, the latter is full but no packages. The best solution is likely still the PiHole, and you can probably setup a device filter against the Deck that only allows Steam traffic. If you're that worried about things you don't want connecting to the internet, you should have a network-wide firewall and/or DNS filtering like PiHole anyway, although sadly harder to get working when not at home.

Or you'd have to create a script that you run every SteamOS update to reinstall packages, not to mention making sure if any daemons you install can autostart and stay running in the background in gaming mode.

[Der tüddelige Fußgänger]

I think thats not really possible, since you're limited to flatpaks, no native, apps

BUT
Go to the app center and download an app called "flatseal" that one lets your control permissions of apps, from internet, printers up to file permissions.
So you can block your office suite from accessing the web since it's, well, just office

[retrogunner]

PiHole is primarily a DNS blackhole for Ad Blocking - not dropping SSH request packets to an IP Address on its network. To do things like packet DROP, you'd need something like IPFire, Pfsense/OPNsense, etc. in front of the Deck -- or use the built-in Linux kernel iptables.

Plus, recommending PiHole solution assumes you're at a location (such as your home) without such an existing solution (I've used OpenDNS for over a decade). If not a home, it would also mean carrying around a Pi Zero to act as your portable router/dns solution -- which isn't practical for a portable game console you connect to a University or other captive login portal.

And a portable firewall device to proxy through doesn't make sense when iptables is baked into the Linux kernel.

ufw is just a more "human readable/usable" CLI way to deal with iptables (and GUFW is the Gnome friendly version and requires ufw.)

The ufw primary use-case for easy host-side firewalling.

For example, I want every non-requested incoming packet to DROP. I need to enable SSH, Game servers, Samba, NFS, etc *when* I need to. I don't want to use a more complicated than necessary iptable command for that. Given I'll be in teh Game Mode GUI, i'd want a GUFW-like way to do so - clicky clicks or toggles.

So, ufw (GUFW) is kind of important for protecting your Deck when on an untrusted network whether your connecting for some workshop items, updates, or have a spur of the moment LAN party at the coffee shop, an apartment's wifi, etc.

[retrogunner]

Potential work around'ish -- make a Flatpak or AppImage while waiting.

I pointed out on the thread about SDR apps references on making an AppImage or Flatpak to bundle up programs to persist between OS Upgrades. I'll be having to look into that once I have my Steam Deck in-hand.

UPDATE: though you likely can make an AppImage or Flatpak, it would still need to be ran with sudo given the iptables command would require root user execution. There's various factors around the sudo needs, so that would be best left to Valve to resolve for the best method -- particularly if they implement a GUFW-like interface for Game Mode.

[L.Brown]

Originally posted by Ghett Klapson:

Some examples that exist that do this: Safing Portmaster and opensnitch. The former is in alpha but has an AUR package, the latter is full but no packages. The best solution is likely still the PiHole, and you can probably setup a device filter against the Deck that only allows Steam traffic. If you're that worried about things you don't want connecting to the internet, you should have a network-wide firewall and/or DNS filtering like PiHole anyway, although sadly harder to get working when not at home.

Yes, a PiHole is something I've wanted to do for a long time, but I've always been put off by the lack of time and the learning curve.

I was just hoping as an interim solution that there was a slightly easier way for the Steam Deck.

Originally posted by The Nintendo guy:

I think thats not really possible, since you're limited to flatpaks, no native, apps

Yeah, but shouldn't it be possible to give me the permission as root to install native programs?

Originally posted by The Nintendo guy:

BUT
Go to the app center and download an app called "flatseal" that one lets your control permissions of apps, from internet, printers up to file permissions.
So you can block your office suite from accessing the web since it's, well, just office

Thank you. But when I open the app the only application I see is flatseal itself? Do I have to give the program at first certain permissions that this app can show me other apps? And does flatseal then really show me the games as applications?

[Der tüddelige Fußgänger]

Originally posted by L.Brown:

Originally posted by Ghett Klapson:

Some examples that exist that do this: Safing Portmaster and opensnitch. The former is in alpha but has an AUR package, the latter is full but no packages. The best solution is likely still the PiHole, and you can probably setup a device filter against the Deck that only allows Steam traffic. If you're that worried about things you don't want connecting to the internet, you should have a network-wide firewall and/or DNS filtering like PiHole anyway, although sadly harder to get working when not at home.

Yes, a PiHole is something I've wanted to do for a long time, but I've always been put off by the lack of time and the learning curve.

I was just hoping as an interim solution that there was a slightly easier way for the Steam Deck.

Originally posted by The Nintendo guy:

I think thats not really possible, since you're limited to flatpaks, no native, apps

Yeah, but shouldn't it be possible to give me the permission as root to install native programs?

Originally posted by The Nintendo guy:

BUT
Go to the app center and download an app called "flatseal" that one lets your control permissions of apps, from internet, printers up to file permissions.
So you can block your office suite from accessing the web since it's, well, just office

Thank you. But when I open the app the only application I see is flatseal itself? Do I have to give the program at first certain permissions that this app can show me other apps?

No, flatseal should work out of the box.
Do you have any other apps installed from discover, or did you download everything from the terminal (using the pacman command)?
The goal of an immutable file system is to make sure that the important parts of the os aren't tinkered with. Especially useful for a console, to make sure people don't kill their system on accident.

Just download an app from the app store like chromium, libreoffice or whatnot and check if it shows up. At least i never had problems with flatseal.

[L.Brown]

Originally posted by retrogunner:

Just download an app from the app store like chromium, libreoffice or whatnot and check if it shows up. At least i never had problems with flatseal.

Yes, after downloading another app from the app store this app is shown me in flatseal. But not steam or any installed game. So I think this is limited to downloaded flatpak-apps?

Originally posted by retrogunner:

Potential work around'ish -- make a Flatpak or AppImage while waiting.

I pointed out on the thread about SDR apps references on making an AppImage or Flatpak to bundle up programs to persist between OS Upgrades. I'll be having to look into that once I have my Steam Deck in-hand.

That sounds interesting and purposeful, but unfortunately I don't have Arch, only Ubuntu on my laptop. Probably, also because my knowledge in the field is very limited, I will have to wait rather for solutions from people like you.

[Der tüddelige Fußgänger]

Originally posted by L.Brown:

Originally posted by retrogunner:

Just download an app from the app store like chromium, libreoffice or whatnot and check if it shows up. At least i never had problems with flatseal.

Yes, after downloading another app from the app store this app is shown me in flatseal. But not steam or any installed game. So I think this is limited to downloaded flatpak-apps?

Originally posted by retrogunner:

Potential work around'ish -- make a Flatpak or AppImage while waiting.

I pointed out on the thread about SDR apps references on making an AppImage or Flatpak to bundle up programs to persist between OS Upgrades. I'll be having to look into that once I have my Steam Deck in-hand.

That sounds interesting and purposeful, but unfortunately I don't have Arch, only Ubuntu on my laptop. Probably, also because my knowledge in the field is very limited, I will have to wait rather for solutions from people like you.

from what I've read on some other forum here, stema is installed natively, not as a flatpak.
Also even if steam was a flatpak, all games would also use steam settings
Like if i denie internet access to steam, all my games would also loose access. Otherwise this would probably be a pretty major exploit, if an app could bypass the sandboxing just like that.