Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been reading around but can't seem to find a way to create per-process firewall rules. I know about iptables --uid-owner but that only works for outgoing traffic. I've considered scripting netstat and iptables but this seems terribly inefficient since if a process is only active for a small time-frame the script might miss it. Basically I want to enforce specific restrictions regarding port and dst on a process while leaving other processes unaffected. Any ideas?

For reference selinux can do exactly this and it works fairly well. Setup is a bit of a pain though.

share|improve this question
Maybe LXC (Linux Containers) will do the trick? lxc.sourceforge.net – nsg Feb 21 '12 at 13:29
What is so difficult about selinux? Sure there is a bit of a learning curve, but there are great tools, both graphical and command line to assist with configuration. Support is available on IRC on #selinux as well as #fedora – bodhi.zazen Dec 12 '13 at 21:59
have you tried using Douane instead? askubuntu.com/a/330259/46437 – Aquarius Power Oct 8 '14 at 4:51

Your question is a very similar to http://stackoverflow.com/questions/5451206/linux-per-program-firewall-similar-to-windows-and-mac-counterparts

There was the --cmd-owner for iptables's owner module, but it was removed because it worked not properly. Now a first beta version of Leopard Flower is available, which solves the problem by a user space daemon.

In general a per-process firewall is not very useful unless you really isolate and restrict the programs. For this, you should look at security solutions like TOMOYO Linux, SELinux, AppArmor, grsecurity, SMACK,...

share|improve this answer

Easy, run your process under different user and use '--uid-owner' :)

share|improve this answer
That was my first thought as well but as I noted it doesn't work for listening processes. – s3c Feb 21 '12 at 13:13
What is exactly your intention? To be sure a specific owner/process has its own openports for incoming/outgoing connection? – Jiri Xichtkniha Feb 22 '12 at 8:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.