0

I'm trying to build an iptables filter to block everyone but UID 1000 from accessing the internet. This is what I have so far:

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -m owner --uid-owner 1000 -j ACCEPT
-A OUTPUT -j REJECT --reject-with icmp-net-unreachable
-A OUTPUT -j DROP
-A INPUT -i lo -j ACCEPT
-A INPUT -j DROP
-A FORWARD -j DROP
COMMIT

When I try running the following as root (UID 0):

curl http://ipecho.net/plain
curl: (7) Failed to connect to ipecho.net port 80: Network is unreachable

iptables blocks it, as desired. But when I try this as root:

curl --proxy socks5h://localhost:7777 http://ipecho.net/plain
_ip_address_

it goes through fine. What do I need to change to block all internet access from other users, even when they use a proxy?

1 Answer 1

2

If you use a local proxy then the outgoing network traffic will be uid-owned by the proxy not the end user. I assume the proxy is running as uid 1000. What are you using as a proxy?

You need to use a proxy that can be configured to allow only specified local users use it.

You must log in to answer this question.