Confusing.

[masterofobzene]

Opensnitch shows all connections made to 127.0.0.1 even with internet domains like github.com. This happens a lot with windows app through wine. I just don't know what am I allowing, 127.0.0.1 is my machine, so it should be safe, but why is the original app sending me the dns request instead of directly to github?

The program as it is now is very confusing, twice for the wine apps (the real danger after all)
If you know "simplewall" that is the idea of firewall that I have; sadly its windows only.

[gustavo-iniguez-goya]

Your system is probably configured to resolve domains via 127.0.0.1 (cat /etc/resolv.conf). So the first DNS query from the apps goes to the IP 127.0.0.1 port 53, and then the DNS stub resolver opens a DNS request to the public servers (1.1.1.1, 8.8.8.8, ...).

If you have allowed systemd-resolved or dnsmasq, edit the rule to allow connections from those binaries AND to the port 53 .

[masterofobzene]

I haven't enabled or allowed anything, it is default in linux mint 22.1.
I still don't understand why everything goes localhost first but I'm a linux noob. Sounds redundant to me since the router will take care of everything. Wine apps is what worries me since windows ecosystem is always spying users, it is really confusing because opensnitch will show a popoup telling me wine wants to connect to (for example) 127.0.0.1 on port 5425, what do I do with that? It doesn't even tell me to which dns it is trying to reach sometimes (most of the time), also true for ipv6 connections

[masterofobzene]

also... if I want to delete all my rules, if I select all then hit right click it selects only the rule I clicked on. How can I delete all rules?

[masterofobzene]

Ok, been tinkering a little. Had to manually remove all rules from the etc dir; no big deal but would be nice if the interface worked for doing that.

Now I understand (barely) why all calls are being made to localhost. Is there any way to configure opensnitch to show the dns request always even if it goes to localhost? I ask this because I'm, getting lots of popups only telling me for example: a/lot/of/folders/winesever/something wants to connect to 127.0.0.1, but that's it. I don't know what is connecting to where.

Sometimes, the path to the binary trying to establish the connection is so long that I simply fail to see what is it because it gets cut.

EDIT: I know I've said "Opensnitch shows all connections made to 127.0.0.1 even with internet domains like github.com" but I realized that only a few apps show the destination, the rest will mostly show 127.0.0.1 and no final destination.