Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Sometimes I upload an application to a server that doesn't have external internet access.

I would like to create the same environment in my machine for testing some features in the application and avoid bugs (like reading a rss from an external source).

I thought about just unplugging my ethernet cable to simulate, but this seems archaic and I don't know if I'm going to raise the same exceptions (specially in Python) when doing this compared to the limitations at the server.

So, how do I simulate "no external access" in my development machine? Will "deactivating" my ethernet interface and reactivating later (with a "no hassle" command) have the same behavior as the server with no external access?

I'm using Ubuntu 10.04. Thanks!

share|improve this question
up vote 8 down vote accepted

Deleting the default route should do this. You can show the routing table with /sbin/route, and delete the default with:

sudo /sbin/route del default

That'll leave your system connected to the local net, but with no idea where to send packets destined for beyond. This probably simulates the "no external access" situation very accurately.

You can put it back with route add (remembering what your gateway is supposed to be), or by just restarting networking. I just tried on a system with NetworkManager, and zapping the default worked fine, and I could restore it simply by clicking on the panel icon and re-choosing the local network. It's possible that NM might do this by itself on other events, so beware of that.

Another approach would be to use an iptables rule to block outbound traffic. But I think the routing approach is probably better.

share|improve this answer

You wrote

So, how do I simulate "no external access" in my development machine?

How do I "deactivate" my ethernet interface and reactivate later with no hassle?

Are these two questions or one question? I'm not sure what you mean by simulate "no external access". However, to deactivate the ethernet interface you could simply do

#ifdown eth0
#ifup eth0

or whatever your internet device is. This will bring your ethernet interface down and up, respectively.

share|improve this answer
Simple, safe, sure to work. Just remember that you may have to rerun your DHCP client (for desktop this may be automatic, or you may have to click on the network manager applet and choose "Connect"). – phunehehe Mar 21 '11 at 15:45

You could run your code in a virtual machine (User Mode Linux, VServer, OpenVZ, VirtualBox, VMWare, KVM, …) that you provide with only a host-only network interface (i.e. no routing from the VM to anywhere but the host machine).

If you run the application as a dedicated user appuser, you can restrict that user's network access. Make sure you have iptables (Ubuntu: iptables Install iptables) and iproute2 (ip command) (Ubuntu: iproute Install iproute, iproute-doc Install iproute-doc) installed. Then you can use iptables to mark outgoing traffic from processes running as appuser, and ip rule and ip route to set up an alternate routing table for that user.

ip rule add fwmark 1 table 1
ip route add table 1 dev lo
iptables -t mangle -A OUTPUT -m owner --uid-owner appuser -j MARK --set-mark 1

(Note: untested. See also more Linux IP packet mangling examples.)

share|improve this answer

This is what containers are for ( https://linuxcontainers.org/ ) they are a bit like chroot, but finer grained, and have network control, and other things, as well.

Unfortunately I have no idea how to use them. (My training only went as for as knowing they exist, and roughly what they do.)

docker is an application that manages containers, you do not want to do it manually.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.