18

On our Ubuntu machine I have attempted to block internet access to one of the user accounts by adding the following line to /etc/network/interfaces:

pre-up iptables -A OUTPUT -p tcp -m owner --uid-owner 1001 -j DROP

This works well except somehow Youtube and other Google properties are not blocked.

I'm not an expert in iptables, but I assumed the above command would drop all outgoing requests from the specified user. Is there something special about Google properties that would somehow cause them to be exempted?

For reference here is my iptables list:

$ sudo iptables --list

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
DROP       tcp  --  anywhere             anywhere             owner UID match ****
Improve this question
3
  • 2
    This can easily be circumvented by tunneling TCP over another protocol, BTW.
    – Jörg W Mittag
    Sep 22, 2019 at 10:14
  • 4
    Is there any chance your Internet connection is IPv6 enabled? That would not be blocked by an iptables rule.
    – penguin359
    Sep 23, 2019 at 4:51
  • Note that this will soon start applying to many more sites, not just Google and YouTube. Today Cloudflare announced that they have support for HTTP/3, Mozilla announced that Firefox will have support very soon, and it's only a matter of time before lots of other join in. HTTP/3 is based on Google's QUIC protocol and also runs over UDP, so it has the same issue.
    – Moshe Katz
    Sep 26, 2019 at 18:34

1 Answer 1

Reset to default
36

Is the user using Chrome/Chromium? If so, the browser is most likely using QUIC for those sites, and that protocol uses UDP as the transport.

You can block UDP ports 80 and 443 to solve it.

Improve this answer
2
  • 10
    You can also just remove -p tcp and thereby block everything.
    – Michael Hampton
    Sep 21, 2019 at 21:15
  • 2
    I wondered if there was something special about Chrome with Google sites. That was definitely it. I removed -p tcp and everything is now blocked.
    – spencerrecneps
    Sep 21, 2019 at 23:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .