Is there an interactive firewall for outbound traffic on Ubuntu?

Question

I wish to prevent some programs from "phoning home", and to allow other programs to access only specific web servers.

Is there any way to interactively allow or decline outbound communication from individual programs on Ubuntu?

Answer 1

You could give Anoubis a try. There are installation instructions and packages for Karmic Koala available (I'm new to superuser, so you'll have to find them yourself >:-S Hint: on the Download page scroll down to "Distributions").

Answer 2

Well not exactly interactive but I know about 3 ways to restrict network access to programs.

1. By default linux assigns permissions to users and every program they run has the same permissions. Run the untrusted program as a separate user. This is pretty simple if you can do it. (Sometimes you can't like when a program requres root privileges.) Add the following firewall rule:

   iptables -A OUTPUT -m owner --uid-owner ${untrusted_uid} -j DROP
   

2. If you are not afraid of patching the kernel try grsecurity. It allows different permissions for different executables for the same user. This is probably the best way because you can integrate it with iptables rules and specify detailed restrictions. The rules should look something like:

   ...
   role your_regular_user u
       ...
       subject /path/to/untrusted/program
           connect disabled
       ...
   ...
   

3. Disable the connect() function with LD_PRELOAD. This is the ugliest way only use it if you have no other option. You will need a library like this:

   #include <errno.h>
   #include <stdio.h>
   #include <sys/types.h>
   #include <sys/socket.h>
   
   
   int connect(int sockfd, struct sockaddr const* addr, socklen_t addrlen) {
       errno = ECONNREFUSED;
       printf("connection refused\n");
       return -1;
   }
   

   Compile this with

   gcc -fPIC -shared -Wl,-soname,fake_connect fake_connect.c -o libfake_connect.so
   

   Start the program with

   LD_PRELOAD="./libfake_connect.so" ./untrusted_program
   

Answer 3

That would be netfilter/ipfilter with some script that would do things interactively (maybe with the nice API available on Ubuntu) using a background scripting.

There is some old discussion at this UbuntuForums page.
Also see, Ubuntu IPTablesHowTo and Firewall pages.

Answer 4

I had been using gufw for some time, it's nice and easy to install/configure. gufw doesn't come with Ubuntu installations. You have to install it manually 'sudo apt-get install gufw'.

Here are some of the references.

https://help.ubuntu.com/community/Gufw