Recently, I have encountered a problem of limiting Internet Access to specific programs. Could anybody recommend a good way of doing that, without using any particular software?
The solution for me happened to be straight forward.
In case you would want to make an exception and allow a program to access local network:
NOTE: In case of spawning the rules will be maintained. For example, if you run a program with no-internet rule and that program will open browser window, still the rules will be applied.
A few notes Ilia:
Ad 1: - to modify existing user: usermod -a -G groupName userName - check with : sudo groups userName
Ad 3: - I already have a lot of rules in iptables, The position of the new rule is crucial. should be the first rule in chain OUTPUT. Therefore I use insert : iptables -I OUTPUT 1 -m owner --gid-owner no-internet -j DROP
To allow access to LAN: make sure the ACCEPT rules are above the DENY rule.
Works like a charm. Use it for example on Wifiguard. Prog checks wlan for unknown devices, but "phones home" on every start.