Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How to block access to a local user to a local port?

Example: user Elvis should not have access to the port 25600 on the same server.

share|improve this question

Iptables has an owner module that you can use

This module attempts to match various characteristics of the packet creator, for locally-generated packets. It is only valid in the OUTPUT chain, and even this some packets (such as ICMP ping responses) may have no owner, and hence never match.

You would want to use

--uid-owner userid Matches if the packet was created by a process with the given effective user id.

You just need to combine this with other suitable iptables parameters e.g. --dport to make the filter that works for you.

share|improve this answer

The full command as mentioned by Iain would look something like this

iptables -t filter -A OUTPUT -p tcp --dport 25600 --match owner --uid-owner 503 -j DROP

Just remember to edit the --uid-owner 503 to the correct UID for user Elvis

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.