Currently, when I need to focus, I use a separate device configured to block everything except 2-3 domains I really need to minimize distractions. What really makes Sinkzone interesting is the scheduling with focus mode which can be incredible useful. My current firewall, OpenSnitch only lets you toggle all rules at once, so Sinkzone could be useful for allowing just the focus domains.
I think a useful feature to consider is having different profiles which would essentially be collections of domains to allow. So you could have "focus", but also "work" or "kids" as well allowing for more flexibility.
As I previously mentioned, I'm currently using OpenSnitch [1] as a system-level firewall that has a similar allowlist-only functionality. While the popups to allow/reject a connection initially disturb your workflow, after a short period of usage, you end up with a small collection of rules and you'll pretty much only see them again when browsing new websites. The advantage over DNS-level blocking is that you also get to block per process and not just device (or network). Since it uses eBPF, processes can't get around it by using a different DNS server or something. I'm really missing profiles and scheduling though, so I hope you can build a viable alternative to switch to!
I like this tool a lot and think it's superior to my own automation tools to generate giant host file blocklists. So, I'll be looking into switching to sinkzone. That said, my understanding is that applications can still make direct connections where an application connects using an IP address (without looking it up via DNS). I guess I use firewalls for that but haven't gotten around to adjusting anything from the defaults. Also could use a reverse proxy but haven't taken the time to set one of those up yet either. Does anyone have recommendations for a 'second step' on the network security path? Setup a PF router?
I see it has a Windows installer. I might have to try that on my old Win7 Pro system.
I will likely move on to Win10 now that it is ending support later this year so I might try there too. Windows support is best consumed in small chunks so once they deep-six Win10 it will be ready for consumption since the only "updates" it is likely to get are those strictly related to protecting it from malware.
Years ago there was a software firewall called SyGate that allowed a user to block everything and then set allow rules as they needed so that the only applications that could get out were those explicitly allowed by the user. The internet was young and there were fewer bad actors so it was way ahead of its time on the consumer side. You could install the free version or pay for a premium version. It was bought out in the late 90's I think by Norton or one of those other big units (Symantec?) who used all the good parts in their own "improved" firewalls, for a lot of money though.
I like this idea of blocking everything except the things you know you need.
Will this work when I'm connected to the company vpn? We have a private DNS zone set up for our private network, and this would probably mess up my DNS config. It would be awesome if it worked though!
You can configure your upstream resolvers in the config, so I think Sinkzone can be placed in front of your VPN's resolver. I never tested this to be honest.
Hey Eszpee, Thanks for checking Sinkzone out. I'm thinking about building custom schedules in the next iteration, that would support some basic pomodoro style scheduling for sure.
This sounds awesome - I wish I could run it on my iphone, because otherwise it's not even gonna put a dent in my infinite capacity for slacking off....
I think the idea is that it blocks everything on your machine instead of causing the whole network to go offline as piholes are generally applied to the entire home network.
Your mileage might vary, but in my home, causing my smarthome plus my wife and children’s internet to go offline might cause a bigger distraction to my focus. Also you couldn’t use a pi-hole at work for instance.
I'm not familiar with this project, just checked their GitHub Readme and if I understand correctly they block what you want them to block. Sinkzone does the opposite, it allows what you want to allow, and blocks everything else.
Well, you can block everything using a wildcard blocking rule (for that, go to "Filters → DNS blocklists" and add this custom rule: ||*^ ) and then you can allow the domain (and subdomains, if needed, for instance "everything.ycombinator.com"; for that, go to "Filters → Allowlist" and add this: @@||ycombinator.com^ )
Looks really streamlined!
Currently, when I need to focus, I use a separate device configured to block everything except 2-3 domains I really need to minimize distractions. What really makes Sinkzone interesting is the scheduling with focus mode which can be incredible useful. My current firewall, OpenSnitch only lets you toggle all rules at once, so Sinkzone could be useful for allowing just the focus domains.
I think a useful feature to consider is having different profiles which would essentially be collections of domains to allow. So you could have "focus", but also "work" or "kids" as well allowing for more flexibility.
As I previously mentioned, I'm currently using OpenSnitch [1] as a system-level firewall that has a similar allowlist-only functionality. While the popups to allow/reject a connection initially disturb your workflow, after a short period of usage, you end up with a small collection of rules and you'll pretty much only see them again when browsing new websites. The advantage over DNS-level blocking is that you also get to block per process and not just device (or network). Since it uses eBPF, processes can't get around it by using a different DNS server or something. I'm really missing profiles and scheduling though, so I hope you can build a viable alternative to switch to!
[1]: https://github.com/evilsocket/opensnitch
I like this tool a lot and think it's superior to my own automation tools to generate giant host file blocklists. So, I'll be looking into switching to sinkzone. That said, my understanding is that applications can still make direct connections where an application connects using an IP address (without looking it up via DNS). I guess I use firewalls for that but haven't gotten around to adjusting anything from the defaults. Also could use a reverse proxy but haven't taken the time to set one of those up yet either. Does anyone have recommendations for a 'second step' on the network security path? Setup a PF router?
I use hagezi lists via rpz for dns blocking with my own specified first for custom blocks and whitelisting.
Most of my ip blocking is by country or company. I have country, company-block, and company-allow lists in pf that are updated nightly.
I have found that once your dns list is sufficiently robust you rarely trigger an ip block. I have to add a new domain about once a month.
I see it has a Windows installer. I might have to try that on my old Win7 Pro system.
I will likely move on to Win10 now that it is ending support later this year so I might try there too. Windows support is best consumed in small chunks so once they deep-six Win10 it will be ready for consumption since the only "updates" it is likely to get are those strictly related to protecting it from malware.
Years ago there was a software firewall called SyGate that allowed a user to block everything and then set allow rules as they needed so that the only applications that could get out were those explicitly allowed by the user. The internet was young and there were fewer bad actors so it was way ahead of its time on the consumer side. You could install the free version or pay for a premium version. It was bought out in the late 90's I think by Norton or one of those other big units (Symantec?) who used all the good parts in their own "improved" firewalls, for a lot of money though.
I like this idea of blocking everything except the things you know you need.
For application level firewalling like you describe I use:
https://github.com/tnodir/fort
While we're throwing out recommendations for Windows software firewalls, I've previously used and liked Portmaster. Nice UI and its open source
https://safing.io/portmaster/
https://github.com/henrypp/simplewall
I like SimpleWall but it’s really wonky at times. Especially the UI and its search algorithm for searching rules or programs.
Will this work when I'm connected to the company vpn? We have a private DNS zone set up for our private network, and this would probably mess up my DNS config. It would be awesome if it worked though!
You can configure your upstream resolvers in the config, so I think Sinkzone can be placed in front of your VPN's resolver. I never tested this to be honest.
Sounds interesting! The Pomodoro app I'm using for focus times has this feature built in (I wrote about it here: https://peterszasz.com/finding-focus-through-intention-and-a... ), but before finding that, I would've definitely tried this.
Improvement idea: Integrate with Apple Shortcuts, so the user could automate switching focus mode on and off, tied to changing Apple Focus mode.
Hey Eszpee, Thanks for checking Sinkzone out. I'm thinking about building custom schedules in the next iteration, that would support some basic pomodoro style scheduling for sure.
No DoH support? The browser seems like the source of distractions.
Thank you for the idea, I've created an issue: https://github.com/berbyte/sinkzone/issues/1
exactly my expection as well..
What does DoH mean?
DNS over HTTPS, which is something that browsers (optionally) use to keep DNS traffic in an encrypted channel.
How would you handle export / import functionality?
I really like the inversion of block to allow I think it makes sense.
In my use-case I would allow different lists for different profiles
(on the other hand I have blacklisted domains that I block regardless of using work / private / family profiles)
Interesting approach... Initially I thought it was bit overkill but I found myself picking my phone when I have a site blocked on my laptop.
Happen more than I'm willing to admit, so I guess I will give a try
nextdns lets you set times when domains are blocked. Originally I had it just for my computer but soon realized I needed it for my phone as well.
I'm planning to address the issue for phones as well in the future.
I built a DNS resolver on Proxylity[1] as a demo but it didn’t occur to me that block by default was a use case. I might have to add that.
My suggestion: Allow by ASN would be a clean (simple) way to get all of Google, etc., allowed at once.
[1] https://github.com/proxylity/examples/tree/main/dns-filter
Seems like it would be more useful if were available as a coredns module.
This sounds awesome - I wish I could run it on my iphone, because otherwise it's not even gonna put a dent in my infinite capacity for slacking off....
Run Tailscale/Wireguard on your iPhone, back to your RPi at home. Use your RPi as your DNS server. Something, something, profit.
It's on my list :)
How is this better than using Pi-hole to do the same? It can also run in an allow only mode as I understand.
I think the idea is that it blocks everything on your machine instead of causing the whole network to go offline as piholes are generally applied to the entire home network.
Your mileage might vary, but in my home, causing my smarthome plus my wife and children’s internet to go offline might cause a bigger distraction to my focus. Also you couldn’t use a pi-hole at work for instance.
I wanted to build my tool because eventually I want to support multi-tenancy. Custom allowlists and schedules for all family members.
"can run" / "can be configured to run" / "is not documented but can" != "is purpose built for allowlisting workflow as simple as possible"
<3
- single binary file deployment
- TUI based configuration
- API endpoints
I usually edit my hosts file and point unwanted domains to localhost. This seems more elegant
I've used https://github.com/StevenBlack/hosts myself for a few years, I think this is a fantastic collection for hosts based blocking.
expected it to work on browser as well. but can use /etc/hosts file instead of allowlist which could also work
Yeap yeap - exactly what I needed! When on iOS?!??
AdGuardHome fills the same gap, doesn't it?
I'm not familiar with this project, just checked their GitHub Readme and if I understand correctly they block what you want them to block. Sinkzone does the opposite, it allows what you want to allow, and blocks everything else.
Well, you can block everything using a wildcard blocking rule (for that, go to "Filters → DNS blocklists" and add this custom rule: ||*^ ) and then you can allow the domain (and subdomains, if needed, for instance "everything.ycombinator.com"; for that, go to "Filters → Allowlist" and add this: @@||ycombinator.com^ )
Alternatively, you can do something like this: *$denyallow=example.org|example.com
Blocks everything except example.org and example.com.
Works in AdGuard Home, AdGuard DNS or any other AG product with DNS filtering capabilities: https://adguard-dns.io/kb/general/dns-filtering-syntax/
Sort of, but it's not really designed to be "block first" though you can configure it to do that.
real devops pro contrarian move "what if I broke DNS so hard it actually made me better at my job"