Recently, I have encountered a problem of limiting Internet Access to specific programs. Could anybody recommend a good way of doing that, without using any particular software?
The solution for me happened to be straight forward.
- Create, validate new group; add required users to this group:
grep no-internet /etc/group
- Add user:
useradd -g no-internet username
Note: If you're modifying already existing user you should run:
usermod -a -G no-internet userNamecheck with :
sudo groups userName
- Create a script in your path and make it executable:
chmod 755 /home/username/.local/bin/no-internet
sg no-internet "$@"
- Add iptables rule for dropping network activity for group no-internet:
iptables -I OUTPUT 1 -m owner --gid-owner no-internet -j DROP
Note: Don't forget to make the changes permanent, so it would be applied automatically after reboot. Doing it, depends on your Linux distribution.
4. Check it, for example on Firefox by running:
In case you would want to make an exception and allow a program to access local network:
iptables -A OUTPUT -m owner --gid-owner no-internet -d 192.168.1.0/24 -j ACCEPT
iptables -A OUTPUT -m owner --gid-owner no-internet -d 127.0.0.0/8 -j ACCEPT
iptables -A OUTPUT -m owner --gid-owner no-internet -j DROP
NOTE: In case of spawning the rules will be maintained. For example, if you run a program with no-internet rule and that program will open browser window, still the rules will be applied.