I am looking for a way to prevent a specific process from binding to anything outside of a specific range of local ports. Lets say localhost:50000 - localhost:50050 is an allowed range. I am NOT looking for changing the range of ephemeral ports.

Is it possible to give a process rights to only a very specific range of local ports that it is allowed to bind to? This would be doable if my application were container-friendly, but I need to do this without a docker abstraction layer.

This application attempts a bind(0) where it will randomly pick 5 local ports to bind to.


You can isolate your process into a separate IP name space (see man ip-netns). Then it doesn't matter which port it binds to because you have to forward al traffic there anyway.

To the outside world it would look like as if the process used the right ports (not for netstat but for connections made).

  • I think this is what I was looking for, and alluding to with the comment about containerization. If I were able to put it into a separate name-space context that might work for me. Thanks for the suggestion – Brando___ Aug 9 '17 at 22:10

If you are running your process always as same non-root user, you could use iptables to drop traffic to other than your specified ports using owner module.

If your system is running SELinux, writing a policy to confine your application is likely significantly better option and you do not need to change anything in source code. Tools like polgengui might be useful getting started.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.