Port allow/deny regardless of host about opensnitch HOT 5 CLOSED

That is not the best practice to do on linux with DNS servers because you want to set your nameservers DNS servers to those you want. Once you have allow forever or until quit then it will allow every connection thru that port to the two or three nameservers you have listed in /etc/resolv.conf
Now its not really smart to use ISP nameservers that is why some people use Google Public DNS servers like 8.8.8.8 and 8.8.4.4 and Level3 servers for example 4.2.2.3
If you are smarter then that then you will use OpenNIC servers or some other custom servers. You can also have a master DNS server on your local machine via Berkeley Internet Name Domain server. So there are some reasons why wouldn't want to do that for domain server for example then you couldn't check dns leak.
For unbound, I guess you meant any application to use that port freely you can setup restrictive outgoing IPtables rules and allow any outgoing traffic through that port.
This might not answer your question but I still do think that whole point of opensnitch is to discover host or ip address to which some local outgoing connection is made.
you can btw edit manually also the sqlite database, it not recommended probably except for deleting accidental wrong decisions. if you know the path to the application and which port and ip address it should be allowed to use you can change it by hand. Opensnitch is good because without MAC and without too restrictive iptables rules gives you granular control over the services that make outgoing connections.

from opensnitch.

Well not really, if I use any application with local resolv.conf set to external IP address, I have to allow every application connection to port 53 to remote host. But I like that, I only want all applications to use local dns server, and the local dns server to be the only one allowed to comm with remote IP addresses on port 53.

And yes, I respect the point of opensnitch, but I'd also like it to serve as user-application-network-firewall, similar to LS. And if I want to, ie. accept thunderbird to talk to ports with smtps/submission/pop3s/imaps, but other ports to be notified of, this now requires multiple manual confirmation on IP address, that is assigned from pool of addresses belonging to certain dns a/aaaa record, thus effectively confusing me (without visible dns name or PTR record), instead of helping me to understand and secure my environment.

from opensnitch.

from opensnitch.

@in1t3r also to get back to my original idea, If I enable my local dns server to use port 53, I later on find out, which applications do not honor system settings of resolv.conf or use completely own dns resolver.

That can be applicable to more, ie. which applications do not honor, or do not fully use system set proxy server (if maybe there are requests done outside of the proxy/vpn, which is quite interesting security concern).

from opensnitch.

port range should be simplify
like : 80 - 500 or 80:500 regular expression is difficult to figure out

from opensnitch.