Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Recently, I have encountered a problem of limiting Internet Access to specific programs. Could anybody recommend a good way of doing that, without using any particular software?

share|improve this question

1 Answer 1

up vote 9 down vote accepted

The solution for me happened to be straight forward.

  1. Create, validate new group; add required users to this group:
    • Create: groupadd no-internet
    • Validate: grep no-internet /etc/group
    • Add user: useradd -g no-internet username

      Note: If you're modifying already existing user you should run: usermod -g no-internet username

  2. Create a script in your path and make it executable:
    • Create: nano /home/username/.local/bin/no-internet
    • Executable: chmod 755 /home/username/.local/bin/no-internet
    • Content: #!/bin/bash
                    sg no-internet "$1"

  3. Add iptables rule for dropping network activity for group no-internet:
    • iptables -A OUTPUT -m owner --gid-owner no-internet -j DROP

      Note: Don't forget to make the changes permanent, so it would be applied automatically after reboot. Doing it, depends on your Linux distribution.

   4. Check it, for example on Firefox by running:

  • no-internet "firefox"

In case you would want to make an exception and allow a program to access local network:

  • iptables -A OUTPUT -m owner --gid-owner no-internet -d -j ACCEPT
  • iptables -A OUTPUT -m owner --gid-owner no-internet -d -j ACCEPT
  • iptables -A OUTPUT -m owner --gid-owner no-internet -j DROP

NOTE: In case of spawning the rules will be maintained. For example, if you run a program with no-internet rule and that program will open browser window, still the rules will be applied.

share|improve this answer
A few notes Ilia: Ad 1: - to modify existing user: usermod -a -G groupName userName - check with : sudo groups userName Ad 3: - I already have a lot of rules in iptables, The position of the new rule is crucial. should be the first rule in chain OUTPUT. Therefore I use insert : iptables -I OUTPUT 1 -m owner --gid-owner no-internet -j DROP To allow access to LAN: make sure the ACCEPT rules are above the DENY rule. Works like a charm. Use it for example on Wifiguard. Prog checks wlan for unknown devices, but "phones home" on every start. –  user205602 Jan 15 at 14:01
@rob thanks, pal! –  Ilia Rostovtsev Jul 30 at 13:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.