1

I have two programs both of which are in Java.

Program A was written by me. If it wants to establish an external connection, I'm okay with this.

Program B was not written by me. If it wants to establish an external connection, I'm not okay with this.

How can I configure iptables to allow java A to make outgoing connections, but java B to be denied?

If iptables can't be used for this, what other options do I have?

Improve this question
1
  • Do the two programs use different ports, or do they use the same port? If they use the same port, iptables cannot (AFAIK) differentiate between the two programs.
    – Cocowalla
    Apr 25, 2011 at 18:29

2 Answers 2

Reset to default
4

If you run the programs as different users you can use the owner module.

iptables -A OUTPUT -m owner --uid-owner javaauser -j ACCEPT
iptables -A OUTPUT -m owner --uid-owner javabuser -j REJECT
Improve this answer
3
  • Great idea! Hadn't thought of that and side-steps the case where the dest port is the same.
    – dmourati
    Apr 25, 2011 at 18:54
  • Oh... oh wow. I like it, it definitely solves my problem. +1, +check. On a related note, is there a way to add logging to failed attempts? Assuming there is, would the explanation of how be short enough to fit in a comment, or should I make a new question? Thanks! :-)
    – corsiKa
    Apr 25, 2011 at 19:34
  • Add iptables -A OUTPUT -m owner --uid-owner javabuser -j LOG before the -j REJECT line.
    – Mark Wagner
    Apr 25, 2011 at 20:03
0

You must block the port that the program you don't want external access uses. Suppose it uses port 30000:

 # iptables -A OUTPUT -s 0/0 -d 0/0 -p tcp --dport 30000 -j DROP

This is a simple rule, you can learn more on this simple howto. Depending on what distribution you use, you can also try AppArmor, a kernel level application firewall.

Improve this answer
3
  • What if I won't know what ports it wants to use until it runs?
    – corsiKa
    Apr 25, 2011 at 19:32
  • Then iptables may not be the right tool for the job.
    – coredump
    Apr 25, 2011 at 19:40
  • Just match on owner. This will disable that owner from connecting entirely. This may be a problem if you use the UID for other things. You may need to exempt some ports. Check the log messages when the program runs to determine the ports and addresses it uses.
    – BillThor
    Apr 25, 2011 at 23:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .