Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I wish to prevent some programs from "phoning home", and to allow other programs to access only specific web servers.

Is there any way to interactively allow or decline outbound communication from individual programs on Ubuntu?

share|improve this question

You could give Anoubis a try. There are installation instructions and packages for Karmic Koala available (I'm new to superuser, so you'll have to find them yourself >:-S Hint: on the Download page scroll down to "Distributions").

share|improve this answer

Well not exactly interactive but I know about 3 ways to restrict network access to programs.

  1. By default linux assigns permissions to users and every program they run has the same permissions. Run the untrusted program as a separate user. This is pretty simple if you can do it. (Sometimes you can't like when a program requres root privileges.) Add the following firewall rule:

    iptables -A OUTPUT -m owner --uid-owner ${untrusted_uid} -j DROP
  2. If you are not afraid of patching the kernel try grsecurity. It allows different permissions for different executables for the same user. This is probably the best way because you can integrate it with iptables rules and specify detailed restrictions. The rules should look something like:

    role your_regular_user u
        subject /path/to/untrusted/program
            connect disabled
  3. Disable the connect() function with LD_PRELOAD. This is the ugliest way only use it if you have no other option. You will need a library like this:

    #include <errno.h>
    #include <stdio.h>
    #include <sys/types.h>
    #include <sys/socket.h>
    int connect(int sockfd, struct sockaddr const* addr, socklen_t addrlen) {
        errno = ECONNREFUSED;
        printf("connection refused\n");
        return -1;

    Compile this with

    gcc -fPIC -shared -Wl,-soname,fake_connect fake_connect.c -o

    Start the program with

    LD_PRELOAD="./" ./untrusted_program
share|improve this answer

That would be netfilter/ipfilter with some script that would do things interactively (maybe with the nice API available on Ubuntu) using a background scripting.

There is some old discussion at this UbuntuForums page.
Also see, Ubuntu IPTablesHowTo and Firewall pages.

share|improve this answer

I had been using gufw for some time, it's nice and easy to install/configure. gufw doesn't come with Ubuntu installations. You have to install it manually 'sudo apt-get install gufw'.

Here are some of the references.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .