1

I'm struggling with iptables. I want to block ALL outgoing traffic except for a single piece of software that runs under the a specific user account.

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination         
1    ACCEPT     all  --  anywhere             anywhere             owner UID match test
2    DROP       all  --  anywhere             anywhere      

This doesn't work. The test user can ping from the command prompt but for example browsing with Firefox doesn't work.

If I add an extra rule for the user that my software is running under (I think that user is a service account? It was created by the software on install) I'm not a Linux expert) I have the same problem. Looking at the application logs it appears the software is unable to access the Internet.

When I add a accept all anywhere anywhere rule everything is working (both for my normal test user and the software user account). I've also tried creating a new normal desktop user and that has the same problem. Ping OK but no internet access through a browser. I get the feeling the user running the software isn't actually the one initiating the connection.

What am I doing wrong?

  • What program are you wanting to run? What interfaces do you have (use ifconfig or ip addr for that)? Also, can you show your iptables -S table so we can see all of your rules? – ErikF Feb 7 '18 at 5:43
  • test@test-VirtualBox:~$ sudo iptables -S -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT -A OUTPUT -p udp -m udp --dport 53 -j ACCEPT -A OUTPUT -m owner --uid-owner 1000 -j ACCEPT -A OUTPUT -j DROP ---------------------- test@test-VirtualBox:~$ ifconfig enp0s3 and lo The stupid thing is that when I add the root user to the output, it suddenly works. Software I use should be irrelevant as its a user I want to give access. – sjaak Feb 7 '18 at 6:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.