to block the application I followed this, but like:

groupadd nonet
adduser $USER nonet
iptables -A OUTPUT -m owner --gid-owner nonet -j REJECT #put at /etc/rc.local

sudo -k iptables --list |grep nonet #to confirm
#REJECT all -- anywhere anywhere owner GID match nonet reject-with icmp-port-unreachable

to test (after reboot):

sg nonet "ping www.google.com" #was blocked
sg nonet "google-chrome" #was able to connect, why?
sg nonet "links2" #was able to connect, why?

# showed all properly being on group nonet
ps --forest -A -o pid,ppid,user,group,cmd |egrep "links|chrome"

So, it did not work for some applications.
How is the correct way to let the firewall rule (by group) work for all applications (when using sg nonet)?

ps.: ubuntu 16.04 here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.