Opensnitch and iptables coexisting

[mokkurkalve]

I've googled this, but just wants to be sure I've understood this right.
First: I've got Arch Linux 7.0.12-zen1-1-zen x86_64, iptables v1.8.13 (nf_tables) and opensnitch 1.7.2-4.
I use a manually configured simple stateful firewall for iptables to handle all incoming. I now installed opensnitch to handle what's outgoing on application level. This all seems to be working great.
Wiki states that opensnitch will coexist nicely with other firewalls. I just want to be sure that there are no effect on what's inbound.
What is somewhat confusing is that there is a GUI for the firewall stating that firewall is enabled and inbound is permitted and outbound is permitted.
I have not touched this at all. I've only configured a bunch of rules for applications as they are asking for outbound connection.
I just want to know if I can just leave the firewall tab as-is. Or if I should just disable it... would that affect my rules for applications? Or if I should set it closer to what my iptable firewall does for default, deny (with exception for a couple ports) for inbound, deny for forward and permit for outbound? Or if I understood this right from the beginning, it doesn't matter in my user case?

[krotname]

I would keep the two things separate here.

The per-application prompts/rules are the outbound connection filtering part. The "Firewall" tab is OpenSnitch's system firewall UI: it can manage nftables rules for input/forward/output policies and allowed inbound services.

So if your existing iptables/nftables rules already handle inbound traffic, you can leave the OpenSnitch firewall tab in its permissive/default state and continue using OpenSnitch only for per-application outbound decisions. Disabling or not configuring the system firewall part should not remove the application rules you already created; those are a different rule set.

I would only mirror your inbound deny policy in that tab if you actually want OpenSnitch to own those system firewall rules too. Otherwise, avoid having two tools manage the same inbound policy and verify with nft list ruleset / iptables-save which chains are installed.

[mokkurkalve]

Thanks! I decided to disable the system firewall tab. That made it necessary to create a rule for ICMP, which now made a lot of pop-ups.
With the applications rules it doesn't seem possible to fine-grain on icmp-types, but I don't think there's a problem allowing all ICMP outbound (my iptables firewall only allows echo inbound). This is the rule I ended up with to stop the icmp-related pop-ups. I don't know if it's possible to fine-grain it any further with the application-rules.

{
  "created": "2026-06-21T12:25:26+02:00",
  "updated": "2026-06-21T12:25:26+02:00",
  "name": "allow-always-ICMP",
  "description": "Permit ICMP",
  "action": "allow",
  "duration": "always",
  "operator": {
    "operand": "list",
    "data": "",
    "type": "list",
    "list": [
      {
        "operand": "protocol",
        "data": "icmp",
        "type": "simple",
        "list": null,
        "sensitive": false
      },
      {
        "operand": "source.port",
        "data": "0",
        "type": "simple",
        "list": null,
        "sensitive": false
      },
      {
        "operand": "dest.port",
        "data": "0",
        "type": "simple",
        "list": null,
        "sensitive": false
      }
    ],
    "sensitive": false
  },
  "enabled": true,
  "precedence": false,
  "nolog": false
}