Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

It is possible on Linux environment to restrict the use of network only on selected applications?

Lets just say, i have very limited prepaid data limit on mobile modem and i want only use that data limit to connect to SSH. while restrict every other application to access the network anyhow.

Is there any solution to this? It will be best, if it is also easy to return to normal.

share|improve this question
Are you asking how to firewall specific ports open and closed, or are you asking about writing rules for specific binaries? ( IOW, where binary one could go out on 22 but binary two couldn't. ) – pboin Jan 20 '12 at 11:16
up vote 2 down vote accepted

iptables, the linux firewall, can do this.

iptable -F
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

Remember not to do this over a remote SSH session.

The first rule will flush the existing firewall rules, the second and third block incoming and outgoing traffic respectively. The fourth rule blocks FORWARDs but that's probably largely irrelevant for you. You can then add entries for traffic you wish to allow as below.

iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT

You haven't specified your linux flavour but you can execute these commands on the command line and then use iptables-save to save your configuration. Alternatively, you can edit /etc/sysconfig/iptables (on a RHEL based distribution, likely elsewhere on others?) and save these commands (minus the iptables prefix, i.e., -A INPUT -p tcp --dport 22 -j ACCEPT) and then load them using iptables-restore.

share|improve this answer

You can secure more or limit ssh connections by using below rules. The following rules allow incoming ssh connections only from 192.168.100.X network.

iptables -A INPUT -i eth0 -p tcp -s --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.