I have a strange behaviour of
iptables that I cannot explain or understand.
I have a user
test which has its primary group
test. I want to block any network access from this user.
Now, if I say
iptables -A OUTPUT -o eth0 -m owner --uid-owner test -j DROP
su test and then I get the following:
ping serverfault.com # WORKS nmap -sP serverfault.com # fails wget serverfault.com # fails
However, if I flush the iptables again, and say instead:
iptables -A OUTPUT -o eth0 -m owner --gid-owner test -j DROP
(notice the difference:
gid instead of
uid) then I get the following
ping serverfault.com # fails nmap -sP serverfault.com # fails wget serverfault.com # fails
So as you can see, the rule seems to match both times, but only when I block the primary group also ICMP is blocked. Is this a bug or does this make some sense that I am unaware of?
I mean I could simply block both and be happy, but I want to understand why they behave differently.
iptables version is