I recently found the following shell script that works with iptables to block all internet access to/from the linux OS, except for terminals opened that were in a group called
This might sound complicated, but it's simple. First, create the "internet" group like so:
sudo groupadd internet
Then, save this into a script:
#!/bin/sh # Firewall apps - only allow apps run from "internet" group to run # clear previous rules sudo iptables -F # accept packets for internet group sudo iptables -A OUTPUT -p tcp -m owner --gid-owner internet -j ACCEPT # also allow local connections sudo iptables -A OUTPUT -p tcp -d 127.0.0.1 -j ACCEPT sudo iptables -A OUTPUT -p tcp -d 192.168.0.1/24 -j ACCEPT # reject packets for other users sudo iptables -A OUTPUT -p tcp -j REJECT # open a shell with internet access sudo -g internet -s
Is the following interpretation of the events taking place correct?
sudo groupadd internetA group called internet is created
sudo iptables -FAll current rules in iptables are cleared
sudo iptables -A OUTPUT -p tcp -m owner --gid-owner internet -j ACCEPTI'm having trouble with this one...
-A OUTPUTtells the terminal to append/add a rule, then according to the documentation
-pis "The protocol of the rule or of the packet to check", so
-p tcpseems to be placing a rule that only reflects the tcp protocol, but what If I want to watch a stream on youtube/twitch? Does
udpneed to be included, and if so, how would I include it?
Then there is the -m (for match). I read the documentation and I am not sure what it does. Right now, I have no idea what
-m owner --gid-owner internet -jmeans. From the comment
# accept packets for internet groupI understand what the code does, but I want to understand what each element is doing in order to get to that conclusion.