16

On our Ubuntu machine I have attempted to block internet access to one of the user accounts by adding the following line to /etc/network/interfaces:

pre-up iptables -A OUTPUT -p tcp -m owner --uid-owner 1001 -j DROP

This works well except somehow Youtube and other Google properties are not blocked.

I'm not an expert in iptables, but I assumed the above command would drop all outgoing requests from the specified user. Is there something special about Google properties that would somehow cause them to be exempted?

For reference here is my iptables list:

$ sudo iptables --list

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
DROP       tcp  --  anywhere             anywhere             owner UID match ****
  • 2
    This can easily be circumvented by tunneling TCP over another protocol, BTW. – Jörg W Mittag Sep 22 at 10:14
  • 4
    Is there any chance your Internet connection is IPv6 enabled? That would not be blocked by an iptables rule. – penguin359 Sep 23 at 4:51
  • Note that this will soon start applying to many more sites, not just Google and YouTube. Today Cloudflare announced that they have support for HTTP/3, Mozilla announced that Firefox will have support very soon, and it's only a matter of time before lots of other join in. HTTP/3 is based on Google's QUIC protocol and also runs over UDP, so it has the same issue. – Moshe Katz Sep 26 at 18:34
35

Is the user using Chrome/Chromium? If so, the browser is most likely using QUIC for those sites, and that protocol uses UDP as the transport.

You can block UDP ports 80 and 443 to solve it.

  • 10
    You can also just remove -p tcp and thereby block everything. – Michael Hampton Sep 21 at 21:15
  • 2
    I wondered if there was something special about Chrome with Google sites. That was definitely it. I removed -p tcp and everything is now blocked. – spencerrecneps Sep 21 at 23:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.