How to block internet access to certain programs on Linux
Solution 1
The solution for me happened to be straight forward.
- Create, validate new group; add required users to this group:
- Create:
groupadd no-internet
- Validate:
grep no-internet /etc/group
- Add user:
useradd -g no-internet username
Note: If you're modifying already existing user you should run:usermod -a -G no-internet userName
check with :sudo groups userName
- Create:
- Create a script in your path and make it executable:
- Create:
nano /home/username/.local/bin/no-internet
- Executable:
chmod 755 /home/username/.local/bin/no-internet
- Content:
#!/bin/bash
sg no-internet "$@"
-
Add iptables rule for dropping network activity for group no-internet:
-
iptables -I OUTPUT 1 -m owner --gid-owner no-internet -j DROP
Note: Don't forget to make the changes permanent, so it would be applied automatically after reboot. Doing it, depends on your Linux distribution.
-
-
Check it, for example on Firefox by running:
no-internet "firefox"
In case you would want to make an exception and allow a program to access local network:
iptables -A OUTPUT -m owner --gid-owner no-internet -d 192.168.1.0/24 -j ACCEPT
iptables -A OUTPUT -m owner --gid-owner no-internet -d 127.0.0.0/8 -j ACCEPT
iptables -A OUTPUT -m owner --gid-owner no-internet -j DROP
NOTE: In case of spawning the rules will be maintained. For example, if you run a program with no-internet rule and that program will open browser window, still the rules will be applied.
Solution 2
A more straightforward possibility: use firejail. It runs the application inside sandbox. At the sandbox, you can control the access of the application to any network or folder in your computer.
To execute a certain application without network access do following:
firejail --net=none <application>
In that case, "The sandbox looks like a computer without any network interfaces." (See Network Section in documentation)
For example, firejail --net=none firefox
will start firefox without any network connection.
Installation
See the Installation documentation.
You should install from the package system in your distribution, or better get the latest version LTS. (For example, this latest LTS version, 9.56.2
, works also in Ubuntu 16.04.)
Solution 3
From answer for How to disable Internet connection for a single process and Block network access of a process
Then, starting a process without network access is as simple as:
unshare -n program ...
This creates an empty network namespace for the process. That is, it is run with no network interfaces, including no loopback. In below example we add -r to run the program only after the current effective user and group IDs have been mapped to the superuser ones (avoid sudo):
unshare -r -n ping google.com
Ilia
DevOps at Virtualmin. Author of Authentic Theme and Karateka for Webmin/Usermin. Bash, Perl. JavaScript, PHP, HTML, CSS. Linux system administration. Testing and debugging.
Updated on September 18, 2022Comments
-
Ilia almost 2 years
Recently, I have encountered a problem of limiting Internet Access to specific programs. Could anybody recommend a good way of doing that, without using any particular software?
-
Admin over 10 yearsA few notes Ilia: Ad 1: - to modify existing user: usermod -a -G groupName userName - check with : sudo groups userName Ad 3: - I already have a lot of rules in iptables, The position of the new rule is crucial. should be the first rule in chain OUTPUT. Therefore I use insert : iptables -I OUTPUT 1 -m owner --gid-owner no-internet -j DROP To allow access to LAN: make sure the ACCEPT rules are above the DENY rule. Works like a charm. Use it for example on Wifiguard. Prog checks wlan for unknown devices, but "phones home" on every start.
-
onse over 8 yearsThe script will only pass the command. If you try launching a programm with parameters, you should use "$@" instead of "$1". For some reason, I had to temporarily store it in a variable for bash to process it correctly: cmd="$@"; sg no-internet "${cmd}"
-
Admin over 8 yearsuse "nointernet" instead of "no-internet". For whatever reason Ubuntu 14.04 can't handle the dash when you try to use sg or chgrp (it prompts for a password, then fails).
-
SarK0Y about 8 yearsunshare -n YourAppToBlock > use "nointernet" instead of "no-internet". perhaps, 'no\\-internet'?
-
Viatorus almost 8 yearsI tried it like described but for me, after adding me to "no-internet" and set the ip-tables I cannot connect to the internet anymore (with and without the bash script no-internet).
-
kasperd over 7 yearsI would change the second line of the script to be
exec sg no-internet "$@"
. -
Ilia over 7 years@kasperd yeah, thanks. Having expansion is a good idea.
-
Ruslan almost 6 yearsIt would be useful to note that for this manual to work one has to have
xt_owner
module loaded (or built-in), so that/proc/net/ip_tables_matches
contains a lineowner
. Otherwise you'll get "no chain/target/match by that name" error fromiptables
command. Also, after adding a group one has togpasswd
it to some valid password, otherwisesg
will give you a crypticInvalid argument
error after you enter "some" password. -
multithr3at3d about 5 yearsNot to revive an old thread, but to avoid the password issues, just use
sudo -g no-internet
. Also it's a little simpler to throw this into a shell alias. Also, I wouldn't recommend usingunshare
, since it probably requires root, and you will be running the untrusted program as root. -
Maciej Krawczyk over 3 yearsI couldn't get this to work when I wanted to use it as a user added to the no-internet group. If you find it more convenient to create a user account with limited network access (e.g. this way you can more easily share file access), use
iptables -A OUTPUT -m owner --uid-owner $USERNAME -j DROP
-
alper over 2 yearsCan I use
firejail
for slurm as well? -
alper over 2 yearsWhy do we need
item 2
? -
loved.by.Jesus over 2 yearsI could not run libreoffice6.0 with
firejail
, but your method worked. :) -
xeruf over 2 yearsany hint on adjusting these to also allow ipv6?