Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running a VM with Debian as the guest OS (I can choose another distro). It has nginx running along with some other software.

Some of the software tries to make outgoing connections (for example checking for updates or sending usage information). I'd like to block it. I'd also be willing to block incoming connections so only the LAN or my own computer (the host) can communicate with it.

How do I setup Linux or the hypervisor (I'm using VMWare player) to not allow Internet usage—only allow my computer and maybe the LAN? The host OS is Windows 7.

share|improve this question

The easiest way is probably just not to have a default route. If you've set up a static IP address, edit /etc/network/interfaces and comment out the "gateway" line.

If you're using DHCP, you may be able to not ask for a gateway (edit /etc/dhcp3/dhclient.conf and change the "request" to not ask for "routers", but I haven't tested this. Alternatively, you could just delete it after...

Finally, you can use iptables for this:

iptables -P OUTPUT DROP
iptables -A OUTPUT -d -j ACCEPT    # let it talk to localhost
iptables -A OUTPUT -d -j ACCEPT # use LAN range here
iptables -A OUTPUT -d -j ACCEPT       # your machine here

Keep in mind access to your DNS servers. If they're not on your LAN, name resolution will not work. (With the iptables approach, its trivial to add in rules to allow access to them).

Also, keep in mind you're disallowing access to (e.g.,) http.us.debian.org, so apt-get update/upgrade isn't going to work. You can fix this with iptables:

iptables -I OUTPUT -m owner --uid-owner 0 -j ACCEPT # allow root to do anything

assuming your services do not run as root.

Most services that auto-check for updates/report usage/etc. can be configured not to. You could also do that.

Also, if you want, you can use iptables to allow replies to incoming traffic from non-LAN machines (by using state tracking). Typing man iptables will give details.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.