I have a custom systemd service which I want to restrict to the local interface. On ctrl.blog systemd application firewalls examples I found that it should be possible to achieve this using only the service file. To make sure its working, I first tried to deny any network access:
[Unit] Description=MyService After=network.target [Service] WorkingDirectory=/var/myservice/ User=msu Group=msu Type=simple Restart=on-failure ExecStart=/opt/myservice/myservice IPAddressDeny=any # should block networking entirely [Install] WantedBy=multi-user.target
However the service is still working, so the line
IPAddressDeny=any seems to have no effect. I then tried to apply an
iptables rule to the
cgroup created by systemd. Again, I tested by applying a rule that should deny all networking:
iptables -A INPUT -m cgroup --path "/system.slice/myservice.service" -j REJECT iptables -A OUTPUT -m cgroup --path "/system.slice/myservice.service" -j REJECT
But the service is still running and now I am out of ideas how to enforce network filters to my systemd service.