Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I try to block the user sandbox from accessing the network with this command:

$ iptables -A OUTPUT -m owner --uid-owner sandbox -j DROP

However, after that I'm still able to ping an external host:

$ sudo -u sandbox ping
PING ( 56(84) bytes of data.
64 bytes from icmp_req=1 ttl=49 time=802 ms
64 bytes from icmp_req=2 ttl=49 time=791 ms

What am I doing wrong?


My configuration looks like this:

$ /sbin/iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
DROP       all  --  anywhere             anywhere             owner UID match sandbox


Apparently ping has setuid root set. I just had to remove it:

chmod u-s /bin/ping
share|improve this question
looks like it works for TCP and UDP, but ICMP gets through. –  kofemann Mar 2 '13 at 20:59
Share your whole ruleset. Perhaps an earlier rule grants access. –  fuero Mar 2 '13 at 21:07

2 Answers 2

up vote 2 down vote accepted

If ping is setuid root on your system, it is root which opens the socket from which ping sends its ICMP echo requests. Thus the rule will never match.

(Note that this is true on EL6, Debian squeeze, etc. More recent distributions have removed ping's setuid bit and replaced it with a capability. In these cases, the rule might match.)

share|improve this answer

Have you made sure that you have the nessesary iptable module loaded?


modprobe ipt_owner

on the console.

share|improve this answer
modprobe ipt_owner exits without any output –  StackedCrooked Mar 2 '13 at 23:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.