LAN toggle switch app setting for KDE Connect and Syncthing

[EhudKirsh]

Hello,

What I love about firewalls like Rethink is that they allow using the principle of least privilege and block network connectivity from apps which don’t need it. However, I think that Rethink isn’t pushing it as far as it should and easily could.
There are two main types of network connectivity: LAN and WAN. It should be possible to block WAN while allowing LAN for some apps like KDE Connect and implementations of Syncthing like Syncthing-Fork and BasicSync, and vice versa.

I don’t see a simple way to currently do it in Rethink, but I’d appreciate it if someone knows and is willing to share how to use the IP Rules or otherwise in Rethink to block LAN from all apps except for KDE Connect and BasicSync, and block WAN from those two.
Right now, going to ‘⚙ Configure’ ➜ ‘Network’ ➜ ’Do not route Private IPs’ and toggling it on seems to allow LAN to all apps.
However, keeping it off and using the ‘Exclude’ setting doesn’t block WAN. It’s between a rock and a hard place because either decision grants unnecessary network connectivity to some apps and therefore doesn’t fully embrace the principle of least privilege.

So here’s my feature request: I’d like to suggest adding a simple toggle switch to app settings in Rethink that would allow or block access to LAN. This would be independent of the Unmetered and Metered toggle switches because I’d like to block LAN from all apps that don’t need it, even if they use WAN. If you agree to implement this, please ensure that these apps would be possible to connect via USB Tethering as well as WiFi. Basically, local IP addresses. This should hopefully be simple enough to implement and make Rethink more secure, private and unique. LAN is a very important part of network connectivity, and a leading firewall should have a toggle switch for it per app. It would be very user-friendly and easier to understand than some of the options that are already there, like: Isolate, Exclude, Bypass DNS & Firewall, Bypass Universal and Bypass app from all proxies. They all sound very similar.

Moreover, I noticed that Rethink shows some of the IP addresses that apps contact and allows adding those directly to the IP Rules in the app settings pages. That’s nice, and I tried it, and maybe I don’t fully know how to use this, but it didn’t work for me.
Perhaps there can be stronger emphasis to make sure that LAN IP addresses are also shown there, so I’ll be able to see which LAN IP addresses and ports KDE Connect and BasicSync use during normal operation and then I’d be able to restrict them only to those, which is even less broad than just LAN.

Thanks.