5

I have been looking for a way to block all my applications from accessing the internet except for 1 or 2 chosen applications.

I looked into Uncomplicated Firewall (ufw) and its respective Gui (gufw):

enter image description here

but gufw doesn't seem to have the option to block specific programs from accessing the internet (which windows firewall does with outbound rules).

QUESTION: Does anyone know how I might be able to get that done?

6

gufw and other default-shipped firewalls aren't designed to filter by application - gufw is an uncomplicated GUI frontend to ufw, and isn't designed to filter on the application level, it's simply an uncomplicated front-end for setting up basic filtering rules based on IP, port, etc.

What you're looking for goes beyond the standard firewall-in-linux rulesets which ufw and gufw can accomodate. There are several suggested methods (the linked one is group-based controls, so you have to add applications you want to access the 'net to a specific group), but there's also other applications such as Douane, which may do this at the application layer as well.

  • Kinda curious why I was downvoted when I even linked to Douane which is another solution... – Thomas Ward Apr 17 '17 at 19:07
  • I didn't downvote it, I will download the application and see how it works! :) – Webeng Apr 17 '17 at 22:29
  • @Webeng didn't say you did, just a global 'broadcast' to what i've observed :P – Thomas Ward Apr 17 '17 at 23:23
1

I found one possible solution for you: Douane - homepage

I didn't, however, find a packaged version for your Ubuntu.

But since everything seems pretty well described on the Douane - GitHub compilation page, I see no problem with it.

  • I will try installing Douane and let you know how it turned out :) – Webeng Apr 17 '17 at 22:29
0

One of the methods that could block internet access on a per application basis is "sandboxing".

Often network access to/from applications is indirectly controlled using firewall rules. It normally happens that an application tries to communicate in a consistent way (either to a specific port/address, or from a specific port/address), and with a firewall you can prevent access to/from a specific port or address in an effort to disable the application's ability to access the internet (or some other computer). However, if an application doesn't communicate in a consistent way it would be very difficult to write firewall rules you were certain blocked all of its networking. It's also possible that an application that you want to work also communicates using the same port/address, and a firewall would likely block both applications.

Sandboxing is a general term for any strategy meant to create a separate environment for an application. One of the common reasons for this is to be fully aware of what the application is interacting with, because by default normally the application cannot access anything outside of its "sandbox" unless you specifically allow it to.

I won't describe a full-on setup, but software like Docker and Kubernetes were designed with exactly this in mind; you can allow as little or as much network access to the software running in their "containers" (aka, sandbox).

Needless to say, it's a lot more work to run everything inside a container, but if there are a few applications in particular that you're concerned about it could be worthwhile for them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.