1

SITUATION:

I recently found the following shell script that works with iptables to block all internet access to/from the linux OS, except for terminals opened that were in a group called internet:

CODE:

This might sound complicated, but it's simple. First, create the "internet" group like so:

 sudo groupadd internet 

Then, save this into a script:

 #!/bin/sh
 # Firewall apps - only allow apps run from "internet" group to run

 # clear previous rules
 sudo iptables -F

 # accept packets for internet group
 sudo iptables -A OUTPUT -p tcp -m owner --gid-owner internet -j ACCEPT

 # also allow local connections
 sudo iptables -A OUTPUT -p tcp -d 127.0.0.1 -j ACCEPT
 sudo iptables -A OUTPUT -p tcp -d 192.168.0.1/24 -j ACCEPT

 # reject packets for other users
 sudo iptables -A OUTPUT -p tcp -j REJECT

 # open a shell with internet access
 sudo -g internet -s

source: https://plus.google.com/+TobyKurien/posts/YZhZJCZmGgm

QUESTION:

Is the following interpretation of the events taking place correct?

  • sudo groupadd internet A group called internet is created
  • sudo iptables -F All current rules in iptables are cleared
  • sudo iptables -A OUTPUT -p tcp -m owner --gid-owner internet -j ACCEPT I'm having trouble with this one... -A OUTPUT tells the terminal to append/add a rule, then according to the documentation -p is "The protocol of the rule or of the packet to check", so -p tcp seems to be placing a rule that only reflects the tcp protocol, but what If I want to watch a stream on youtube/twitch? Does udp need to be included, and if so, how would I include it?

    Then there is the -m (for match). I read the documentation and I am not sure what it does. Right now, I have no idea what -m owner --gid-owner internet -j means. From the comment # accept packets for internet group I understand what the code does, but I want to understand what each element is doing in order to get to that conclusion.

2

Your interpretation is correct.

If you want the whole thing to also apply to UDP packets, you have to add the same set of rules once again, but with -p udp instead of -p tcp. Or just leave out this option and have the rules apply to all packets (though there could be some gotchas with ICMP packets, so it's probably safer to just add both kinds of rules). However, you'll need TCP in the first place to access e.g. Youtube, so even if streaming from Youtube used UDP, you wouldn't be able to watch a stream, because you'll never get this far.

The option -m selects which kind of match to use. You can match on lots of different criteria, and there's even extensions to iptables (man iptables-extensions) with even matching modules. Here, -m owner selects match by ownership of packets, and --gid-owner specifies to match group ownership. So both options together mean "this rule applies only to packets that are send from someone in group internet".

The option -j (originally "jump") specifies what to do when the rule matches. You can jump to a different chain, or you can ACCEPT (stop processing rules and send this packet), or you can REJECT (stop processing rules and ignore this packet).

The next two rules allow packets (ACCEPT) for special destinations (-d), no matter what group the sending application is in, and the last rule drops all packets (REJECT) that didn't match the previous rules. So it's this last rule that does the actual blocking.

There are plenty of tutorials for iptables on the internet, google a bit and pick one you like if you want to learn more details. Some random links that I found useful in the past:

  • Thank you for the detailed response! Regarding the REJECT command done near the end, noticed that only -p TCP was done. If I were to not include that snippet, would that make sure that all protocols are rejected for other users? like so sudo iptables -A OUTPUT -j REJECT – Webeng Apr 19 '17 at 9:11
  • Yes, it would reject all packets. As I said, you have to be careful with ICMP packets ("administrative" packets like "destination not reachable"): If you indiscriminately reject them, you'll break stuff in unexpected ways, not only on your machine, but possible on other machines in the network, and you'll have lots of fun later finding out why it broke. Only do that if you are sure you know what you are doing. At least add a rule to accept all ICMP packets before it. – dirkt Apr 19 '17 at 9:36
  • I see, great to know. I also noticed that there is the ip6tables for IPv6. Would I need to do all the code in the example above again but just replace iptables with ip6tables in order to make sure they apply to IPv6? – Webeng Apr 19 '17 at 9:40
  • In principle, yes. If you are not just curious, and you are planning to actually use this to block users from accessing the internet, it might more sense to ask a new question and clearly describe your goals - there are other ways to block internet access, for example network namespaces. – dirkt Apr 19 '17 at 9:46
  • I actually made that question before this one :) unix.stackexchange.com/questions/359461/… , and this is me researching into one of the responses found. No one in my other question recommended namespaces for the specific scenario however – Webeng Apr 19 '17 at 9:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.