Sometimes I am forced to use really narrow Internet bandwidth of 56kbps. On my Ubuntu desktop I have too many programs, that frequently check something on the net - and hunting and disabling them one-by-one is really troublesome.

I'd like to have some tool, that would deny internet access (by whatever means) to every process except the e.g. the mail client.

Is it possible at all? If so, how?

I imagine, that one way to accomplish it is to open another network device (like /dev/tap1) and set it to route into the /dev/wlan0 (my usual internet device) and guard everything with custom iptables rules, that can be switched on and off. But I am no expert at iptables, so that sort solution, unless someone gives me specific instructions, is useless.

  • You could use iptables as suggested in the answer provided, but I think you're looking for a per process firewall. This doesn't exist at the moment. It's all port restrict/allow. – RobotHumans Sep 12 '14 at 11:20

You can also use iptables to allow/restrict by udp/tcp ports on desired interfaces. For example let's introduce a rule in the filter table in the OUTPUT chain to allow all traffic on tcp/udp port 143 (IMAP).

(sudo) iptables -A OUTPUT -o eth0 -p udp --destination-port 143 -j ACCEPT
(sudo) iptables -A OUTPUT -o eth0 -p tcp --destination-port 143 -j ACCEPT
(sudo) iptables -A OUTPUT -o eth0 -j DROP

I think IMAP goes over TCP but just in case I restrict also UDP protocol. For this matter I am assuming your interface to the internet as eth0. And that your mail client uses IMAP protocol to connect a remote mail server. I just tried it myself and I only have access to the mail server. Remember that the order of the rules is important otherwise it won't do what you expect.

Edit#1: As you asked in the comment. To restore internet traffic just remove the rules you have just inserted. You can do that as follows:

Long way:

(sudo) iptables -D OUTPUT -o eth0 -p udp --destination-port 143 -j ACCEPT
(sudo) iptables -D OUTPUT -o eth0 -p tcp --destination-port 143 -j ACCEPT
(sudo) iptables -D OUTPUT -o eth0 -j DROP

Short way:

(sudo) iptables -nvL --line-numbers

Running the command above will show you in front of each rule a corresponding number which will help you remove the rules using that number instead of rewriting the whole rule. An output example would be as follows:

Chain OUTPUT (policy ACCEPT 73 packets, 8766 bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 ACCEPT     udp  --  *      eth0              udp dpt:143

And then to remove the rule just run this command:

(sudo) iptables -D OUTPUT 1

The short way is also recommended if you haven't set up the rule and you don't really know how exactly was. Although you can reconstruct the rule from the output of iptables with -nvL parameters.

Note: This is the non-persistent way of using iptables which means that you won't maintain the rules if you reboot your system. If you want your rules to be persistent the easiest way is to run the following:

(sudo) iptables-save > /etc/iptables/rules.v4

which saves/dumps your current rules to /etc/iptables/rules.v4. Then after rebooting iptables would read the stored configuration from that files. For IPv6 you use this other file rules.v6. Have in mind that this holds for Debian where you need to install an additional package. Please check this guide for detailed explanation. For Ubuntu I have found this other guide. For other systems you could browse the internet but the principle is the same: You dump your current rules to file and set up a script at boot time to apply those saved rules to the current iptables configuration.

  • Thank you! How can I restore the internet traffic? Will kernel reset the iptables when I restart the network interface with ifconfig eth0 down and ifconfig eth0 up? – Adam Ryczkowski Sep 12 '14 at 20:25
  • See edited answer. – KiaMorot Sep 15 '14 at 8:32
  • And resetting the interface won't restore the traffic. It just sets down and up the interface. The rules you have inserted are in iptables. – KiaMorot Sep 15 '14 at 8:54

You could run your processes in multiple virtual machines. Then you could kill network access for some virtual machines but not others.

  • I have problem with my Ubuntu desktop, which runs entirely on the same logical machine. If you can give me a working way to modify cgroup settings (or other) for it so it uses different network settings than the rest of the computer so the network traffic can be separated, I'll accept it. – Adam Ryczkowski Sep 12 '14 at 20:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.