to block the application I followed this, but like:
groupadd nonet adduser $USER nonet iptables -A OUTPUT -m owner --gid-owner nonet -j REJECT #put at /etc/rc.local sudo -k iptables --list |grep nonet #to confirm #REJECT all -- anywhere anywhere owner GID match nonet reject-with icmp-port-unreachable
to test (after reboot):
sg nonet "ping www.google.com" #was blocked sg nonet "google-chrome" #was able to connect, why? sg nonet "links2" #was able to connect, why? # showed all properly being on group nonet ps --forest -A -o pid,ppid,user,group,cmd |egrep "links|chrome"
So, it did not work for some applications.
How is the correct way to let the firewall rule (by group) work for all applications (when using
ps.: ubuntu 16.04 here