Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two programs both of which are in Java.

Program A was written by me. If it wants to establish an external connection, I'm okay with this.

Program B was not written by me. If it wants to establish an external connection, I'm not okay with this.

How can I configure iptables to allow java A to make outgoing connections, but java B to be denied?

If iptables can't be used for this, what other options do I have?

share|improve this question
Do the two programs use different ports, or do they use the same port? If they use the same port, iptables cannot (AFAIK) differentiate between the two programs. – Cocowalla Apr 25 '11 at 18:29
up vote 4 down vote accepted

If you run the programs as different users you can use the owner module.

iptables -A OUTPUT -m owner --uid-owner javaauser -j ACCEPT
iptables -A OUTPUT -m owner --uid-owner javabuser -j REJECT
share|improve this answer
Great idea! Hadn't thought of that and side-steps the case where the dest port is the same. – dmourati Apr 25 '11 at 18:54
Oh... oh wow. I like it, it definitely solves my problem. +1, +check. On a related note, is there a way to add logging to failed attempts? Assuming there is, would the explanation of how be short enough to fit in a comment, or should I make a new question? Thanks! :-) – corsiKa Apr 25 '11 at 19:34
Add iptables -A OUTPUT -m owner --uid-owner javabuser -j LOG before the -j REJECT line. – Mark Wagner Apr 25 '11 at 20:03

You must block the port that the program you don't want external access uses. Suppose it uses port 30000:

 # iptables -A OUTPUT -s 0/0 -d 0/0 -p tcp --dport 30000 -j DROP

This is a simple rule, you can learn more on this simple howto. Depending on what distribution you use, you can also try AppArmor, a kernel level application firewall.

share|improve this answer
What if I won't know what ports it wants to use until it runs? – corsiKa Apr 25 '11 at 19:32
Then iptables may not be the right tool for the job. – coredump Apr 25 '11 at 19:40
Just match on owner. This will disable that owner from connecting entirely. This may be a problem if you use the UID for other things. You may need to exempt some ports. Check the log messages when the program runs to determine the ports and addresses it uses. – BillThor Apr 25 '11 at 23:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.