Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Is it possible to allow all traffic for a specific program in iptables? Otherwise using nmap and a strict iptables configuration at the same time seems impossible.

share|improve this question
    
You need to be a little clearer. –  goldilocks Mar 8 '13 at 21:06
1  
No, iptables does nothing on the application layer. –  jordanm Mar 8 '13 at 21:46
    
possible duplicate of Redirect traffic through vpn on an as needed basis –  Gilles Mar 8 '13 at 22:57
1  
@jordanm Actually netfilter did briefly have the ability to filter on a PID, but that was removed. You can filter on a per-user basis or on a per-container basis. –  Gilles Mar 8 '13 at 22:59
    
@Gilles I guess that does make my statement somewhat incorrect. –  jordanm Mar 8 '13 at 23:08

2 Answers 2

Using iptables, you can't tell to allow all the traffic from a specific program but you can tell to allow the traffic sent from an application running from a particular user.

For eg.

$ iptables -A OUTPUT -p tcp --dport 992 -d localhost -m owner ! --uid-owner root -j REJECT

This rule tells the kernel to reject packets sent to the local TCP port 992 unless they're sent by one of root's processes.

share|improve this answer
    
The problem of this is that all applications running as root could send packets, and that's not what I want. I would like only nmap, because I need to accept connections in all ports, and have all ports opened for all applications running as root is quite insecure. –  yzT Mar 9 '13 at 11:23

The module owner should be the solution IMHO, too. But making the binary run as SUID may not be useful (even if it would not be SUID root). Instead making it run as SGID and using --gid-owner instead of --uid-owner could even be easier than a container solution (and could enforce the desired effect without cooperation of all users). You would create a group which is either exclusively used for this program or exclusively used for all programms which shall not be bothered by the firewall.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.