Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to block the (outgoing) network access of a single process?

share|improve this question
How do you intend to identify the process? PID, name, path? – Marco Mar 24 '13 at 0:14
What access do you want to block? Some programs use network access via localhost (to the same machine) to do their jobs. – vonbrand Mar 24 '13 at 2:13
See also LD_PRELOAD or similar to prevent network access, if the process is cooperating. – Gilles Sep 1 '13 at 19:50
up vote 43 down vote accepted

With Linux 2.6.24+ (considered experimental until 2.6.29), you can use network namespaces for that. You need to have the 'network namespaces' enabled in your kernel (CONFIG_NET_NS=y) and util-linux with the unshare tool.

Then, starting a process without network access is as simple as:

unshare -n program ...

This creates an empty network namespace for the process. That is, it is run with no network interfaces, including no loopback. In other words:

$ unshare -n ping
connect: Network is unreachable

If your app needs one, you can set a new up;

$ unshare -n -- sh -c 'ifconfig lo up; ping'
PING ( 56(84) bytes of data.
64 bytes from icmp_seq=1 ttl=32 time=0.066 ms

Note that this will create a new, local loopback. That is, the spawned process won't be able to access open ports of the host's

If you need to gain access to the original networking inside the namespace, you can use nsenter to enter the other namespace.

The following example runs ping with network namespace that is used by PID 1 (it is specified through -t 1):

$ nsenter -n -t 1 -- ping -c4 example.com
PING example.com ( 56(84) bytes of data.
64 bytes from icmp_seq=1 ttl=50 time=134 ms
64 bytes from icmp_seq=2 ttl=50 time=134 ms
64 bytes from icmp_seq=3 ttl=50 time=134 ms
64 bytes from icmp_seq=4 ttl=50 time=139 ms

--- example.com ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3004ms
rtt min/avg/max/mdev = 134.621/136.028/139.848/2.252 ms
share|improve this answer
How do you block all programs by default, then start a specific program with network access (basically the opposite of what you show in your answer (share))? – trusktr Aug 3 '13 at 7:28
I've added that to the answer :). – Michał Górny Aug 3 '13 at 10:27
unshare -n seems to throw "Operation not permitted" without root privileges, anything I missing about it? – baldrs Dec 30 '13 at 21:42
Yes. It is inherited by all children spawned after switching the namespace. – Michał Górny Jan 28 '15 at 5:00
I looks like any program that I'd like to unshare e.g. with sudo unshare -n inherits the root right. As I need the sudo to call unshare I'm wondering how I can make sure that the called program doesn't have the root rights. – bonanza May 15 '15 at 15:25

Yes, with customized apparmor profile, i.e

/usr/bin/curl {

    # block ipv4 acces
    deny network inet,
    # ipv6 
    deny network inet6,
    # raw socket
    deny network raw,


But in that way, you will need to generate a list of allowed files to access as well, the whole procedure can be a bit of complicated. And see the help document here

share|improve this answer

Linux has a feature called network namespaces which allow you to essentially have multiple network stacks on the same machine, and assign one to a program when running it. This is a feature typically used for containers, but you can also use it to accomplish what you want.

The ip netns subcommands manage it. Creating a new network namespace with no access to anything is easy, it's the default state of a new namespace:

root@host:~# ip netns add jail

Now, if you switch in to that namespace, you can configure it fairly easily. You'll probably want to bring up lo in it, and that's it:

root@host:~# ip netns exec jail /bin/bash
root@host:~# ip addr add dev lo
root@host:~# ip link set dev lo up
root@host:~# exit

Now when you want to run your command with no network, you just run it in that jail:

root@host:~# ip netns exec jail su user -c 'ping'
connect: Network is unreachable

The network is, as desired, unreachable. (You can do all kinds of interesting things as a separate network stack includes iptables rules, etc.)

share|improve this answer

You cannot do it with iptables alone. This feature briefly existed, but couldn't be made to work reliably and was abandoned.

If you can run the process as a dedicated user ID, iptables can do it with the owner module:

iptables -A OUTPUT -m owner --uid-owner 1234 -j DROP

See examples in Iptables: matching outgoing traffic with conntrack and owner. Works with strange drops, iptables/pf rule to only allow XY application/user?

If you can run the process in its own container, you can firewall that container independently (even make it completely disconnected from the network).

A security module can filter a process's access to networking features. warl0ck's answer gives an example with AppArmor.

share|improve this answer

You could use iptables and move that process into a cgroup:

mkdir /sys/fs/cgroup/net_cls/block
echo 42 > /sys/fs/cgroup/net_cls/block/net_cls.classid

iptables -A OUTPUT -m cgroup --cgroup 42 -j DROP

echo [pid] > /sys/fs/cgroup/net_cls/block/tasks
share|improve this answer

It depends on what distro you're using but that's a feature usually included in the OS's MAC system. As stated previously Ubuntu or SuSE's AppArmor can do this. If you're using RHEL you can configure SELinux to either allow or deny access to a particular port number based on the executing process's label. This is all I could find after some fast googling but there are probably more in depth resources online if you look harder and it gives you the general idea.

share|improve this answer

You can use firejail sandbox (should work on kernels with seccomp feature).

To use it just do

firejail --noprofile --net=none <path to executable>

--noprofile disables default sandbox --net=none disables networking

I do believe that most distros do provide package already but even if they don't firejail has virtually no dependencies other than build toolchain and namespace/seccomp enabled kernel.

There are some other nice features of firejail that can be shown with firejail --help with regards to networking (such as only providing loopback interface or blocking ip/dns etc) but this should do the job. Also, it doesn't require root.

share|improve this answer

You could use a command line program called "proxychains" and try one of the following possibilities:

Set it up that it uses...

  • ...a proxy that does not exist? (I do not know if it will run it with an "invalid" proxy)
  • ...a local proxy (like "tinyproxy", "squid", "privoxy",...) that limits access to the internet? (Just use ACLs)

I have not tested it myself so I do not know if it works...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.