The owner iptables extension has more limitations than you think. From the iptables-extensions man page:
owner
This module attempts to match various characteristics of the packet
creator, for locally generated packets. This match is only valid in
the OUTPUT and POSTROUTING chains. Forwarded packets do not have any
socket associated with them.
- Only OUTPUT is restricted, so you must restrict outgoing connections.
- Not only
userB
, but every user you don't want to make a connection.
- On every host, because if
userB
made this connection from serverC
there would be nothing stopping them.
- You also need to make exceptions if
userB
is going to have network access at all. So you still have to define your service in terms of a connection tuple like ports.
- Plus apparently the owner extension has non intuitive behavior with group membership.
A better solution would be to use authentication in your network protocol.
If you must restrict arbitrary network access of a given user, consider writing SELinux policy similar to the boolean httpd_can_network_connect_db
.