In the past week I arrive Little Snitch on Linux. It's not the same as on macOS, for better and for worse. Its developer admits to being amazed by its speed on Linux, but at least version 1.0.0 displays its interface in the browser. Many Linux users will be delighted with CLI-type tools like if top o nethogsBut having something with a user interface is a completely different story. For many users—and while I love some tools like yt-dlp in the terminal, I could include myself in this group—it's much better.
In this article we will explain everything you need to know To install, configure, and use Little Snitch. I'll tell you right now that it's much more intuitive than any command-line tool, and it works better than OpenSnitch. Let's get started.
Little Snitch Installation
Before we begin, a warning
I've tested it on different operating systems, and I encountered problems on at least two. One was Ubuntu 26.04, and the other was EndeavourOS. In both cases, it installed correctly, but I couldn't boot in either Linux 6.19 or Linux 7.0The kernel used by Resolute Raccoon. My recommendation is to use it on Linux 6.12, where the developer tested it, or on 6.18, where the author of this article had success.
Official information says that It will work on Linux 6.12 and later.But I haven't been able to run it on 6.19 (neither natively nor in a virtual machine) nor on 7.0 (virtual machine).
If it installs and you can't access the operating system, the best thing to do is boot into the terminal. You can do this by selecting the secondary option in the GRUB menu, the one labeled "recovery" or something similar that indicates extra options. Once in the terminal, you can use the command sudo apt remove littlesnitch (or pacman, dnf…) and you can start again.
Installation Process
The installation process is very simple:
- En this link There are official packages. The .deb files are for Debian-based distributions, the .rpm files for Fedora-based distributions or similar, and the .pkg, .tar, and .zst files for Arch. They are available for x86_64, ARM, and RISC architectures.
- It is installed with the appropriate command: Keep in mind that the command is launched in the path where the package is located, or after the install or -U command, the full path is specified:
- Debian/Ubuntu: sudo apt install littlesnitch_1.0.0_amd64.deb
- Fedora, RHEL, etc: sudo dnf install littlesnitch_1.0.0_amd64.deb
- Arch: sudo pacman -U littlesnitch_1.0.0_amd64.deb
In the case of Arch, it exists as a littlesnitch-bin package in the AUR. And that's all. The service will have been added to start with the system.
Using the program
It is best Open a terminal and run LittlesnitchAt least the first time. The reason is simple: when you type the command, the terminal displays "Opened the Little Snitch Web UI in a browser window," which means that it has at least been installed and attempted to run. The web interface will open in a default web browser window, with the URL http://localhost:3031The other times it can be launched from any command-compatible tool, such as Plasma's Kickoff or Krunner.
If you can't see the web interface, I recommend checking the operating system's system monitor. I've seen the "littlesnitch" process using nearly 90% of the CPU on Manjaro with Linux 6.19 (which isn't working), something that doesn't happen on a compatible kernel.
Parts of the interface
At the top, next to the program name, you'll see an "i" which simply provides information about the software. The switch in the center lets you turn the filter on or off. On the far right is the theme button (system, dark, or light), and to its left are the tabs.
The connections will be displayed in the "Connections" tab. The image below shows that Firefox is making many calls, one of them to es.euronews.com, as shown in the left-hand box. The rules are displayed in the right-hand box, and below is a traffic graph (which, at the time of writing, is not refreshing properly).
Let's focus on the left-hand panel, where the connections are. Since it's a virtual machine and I don't know why es.euronews.com is showing up, we'll click on the green ball.
We will automatically see three things: a circular arrow icon will appear on the left to undo changes, the ball will turn red, and in the right section we will see that the rule "Firefox -> domain euronews.com" has been created.
Now you can try going to euronews.com: you'll see it's not possible. This brings us to the third tab, the rules tab.
In this section, we can see the rules we've created. Clicking on one will show us the information, and we can also add a note, which is very useful. Since I'm just testing, I've added that the blocking of euronews.com is a test and that I'm not sure why it's calling there.
We hadn't forgotten about the second tab, which is for blocklists. Here we can add remote blocklists, just like when we add one to an ad blocker.
The Little Snitch service is always running
It's clear why, but it's worth reiterating. For the service to function and manage connections continuously, it's added and runs at system startup. If we don't want this to happen, and prefer to manage connections manually, we can do the following:
- The service is removed from startup:
sudo systemctl disable littlesnitch
- Now, to launch it we will write:
sudo systemctl start littlesnitch
- And to stop it:
sudo systemctl stop littlesnitch
If we want it to start with the system again, in the first command we put "enable"
Little Snitch is easy to use
Little Snitch is truly easy to use. If you know a little English, managing traffic is just a matter of looking and clicking a couple of times. Its clear interface lets you do all this without getting bogged down staring at the terminal or needing to launch multiple processes.