Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to tune up a networking app for network specific things like:

  • make it use a DNS server different than the default one from /etc/resolv.conf
  • make sure it does not try to connect to certain hosts/ports using tcp/udp connections

I know I can get away with just modifying /etc/resolv.conf and writing some iptables rules, but going for a default DENY firewall policy for outgoing IP packets can trigger malfunctions in other services running on the server.

I know I can set up a virtual machine with a whole OS and run my app there, but it seems a bit overkill.

Is it possible to have a networking "jail" for a single app (think single Linux process) that could accept iptables-like rules for network traffic (think in terms of IP packets and above) allowed to and from this particular app? Maybe this is achievable through some dynamically loaded library that can deal with the networking layer, the same manner tsocks does, but more fine-grained?

share|improve this question
up vote 1 down vote accepted

Try using an OpenVZ container. It provides better isolation than a chroot, but with much less overhead than a virtual machine. The container can have its own filesystem, users, IP addresses and iptables rules. The overhead is minimal because the container does not run its own kernel.

share|improve this answer
Alternatively, if running a modern kernel (2.6.29+), look at Linux Containers (LXC) which is basically OpenVZ except that it's in the mainline kernel (no patches required). – earl Jun 18 '10 at 3:24

If you can run the app as a specific user, you can write some iptables rules with the

--uid-owner <user>

flag to match on that specific user.

share|improve this answer
Quote from the iptables manpage: "This match is only valid in the OUTPUT and POSTROUTING chains." Looks like a show stopper to me. – halp Jun 18 '10 at 10:20
When you said "make sure it does not try to connect to certain hosts/ports using tcp/udp connections" did you mean outgoing traffic? A rule in the OUTPUT chain should be sufficient to block that. – rakslice Aug 30 '14 at 23:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.