1

I have a custom systemd service which I want to restrict to the local interface. On ctrl.blog systemd application firewalls examples I found that it should be possible to achieve this using only the service file. To make sure its working, I first tried to deny any network access:

[Unit]
Description=MyService
After=network.target

[Service]
WorkingDirectory=/var/myservice/
User=msu
Group=msu

Type=simple
Restart=on-failure
ExecStart=/opt/myservice/myservice

IPAddressDeny=any # should block networking entirely

[Install]
WantedBy=multi-user.target

However the service is still working, so the line IPAddressDeny=any seems to have no effect. I then tried to apply an iptables rule to the cgroup created by systemd. Again, I tested by applying a rule that should deny all networking:

iptables -A INPUT  -m cgroup --path "/system.slice/myservice.service" -j REJECT
iptables -A OUTPUT -m cgroup --path "/system.slice/myservice.service" -j REJECT

But the service is still running and now I am out of ideas how to enforce network filters to my systemd service.

Improve this question
4
  • 1
    Could it be that your kernel has no support for cgroups firewalling? See unix.stackexchange.com/questions/467362/… – Pro Backup Feb 28 at 22:18
  • When I created a custom cgroup using mkdir /sys/fs/cgroup/net_cls/jail and added a process by echo $PID > /sys/fs/cgroup/net_cls/jail/tasks, the iptables-method worked. Is there an easy way to check for kernel support, though? – staxyz Feb 28 at 22:24
  • You could try setting PrivateNetwork=true instead? – meuh Mar 1 at 9:09
  • This is preventing network access, but now I can not even connect to the service on localhost. – staxyz Mar 1 at 16:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.