Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
I have been looking for a way to block all my applications from accessing the internet except for 1 or 2 chosen applications.
I looked into Uncomplicated Firewall (ufw) and its respective Gui (gufw):
but gufw doesn't seem to have the option to block specific programs from accessing the internet (which windows firewall does with outbound rules).
QUESTION: Does anyone know how I might be able to get that done?
gufw and other default-shipped firewalls aren't designed to filter by application - gufw is an uncomplicated GUI frontend to ufw, and isn't designed to filter on the application level, it's simply an uncomplicated front-end for setting up basic filtering rules based on IP, port, etc.
What you're looking for goes beyond the standard firewall-in-linux rulesets which ufw and gufw can accomodate. There are several suggested methods (the linked one is group-based controls, so you have to add applications you want to access the 'net to a specific group), but there's also other applications such as Douane, which may do this at the application layer as well.
I found one possible solution for you: Douane - homepage
I didn't, however, find a packaged version for your Ubuntu.
But since everything seems pretty well described on the Douane - GitHub compilation page, I see no problem with it.
One of the methods that could block internet access on a per application basis is "sandboxing".
Often network access to/from applications is indirectly controlled using firewall rules. It normally happens that an application tries to communicate in a consistent way (either to a specific port/address, or from a specific port/address), and with a firewall you can prevent access to/from a specific port or address in an effort to disable the application's ability to access the internet (or some other computer). However, if an application doesn't communicate in a consistent way it would be very difficult to write firewall rules you were certain blocked all of its networking. It's also possible that an application that you want to work also communicates using the same port/address, and a firewall would likely block both applications.
Sandboxing is a general term for any strategy meant to create a separate environment for an application. One of the common reasons for this is to be fully aware of what the application is interacting with, because by default normally the application cannot access anything outside of its "sandbox" unless you specifically allow it to.
I won't describe a full-on setup, but software like Docker and Kubernetes were designed with exactly this in mind; you can allow as little or as much network access to the software running in their "containers" (aka, sandbox).
Needless to say, it's a lot more work to run everything inside a container, but if there are a few applications in particular that you're concerned about it could be worthwhile for them.
