0

I want to add a firewall rule that applies to a local interactive user. The intention is to clamp down the box, and only allow web and mail related connections, and update service connections. On occasion, I'll need to open a browser to look up a setting so I may need to allow the outbound connection when I'm sitting at the keyboard.

The Linux iptables Pocket Reference does not address the topic.

Question: Is it possible to add a firewall rule that filters based on "local user" and an "interactive user" objects?

Improve this question

1 Answer 1

Reset to default
1

You can filter outgoing packets based on the uid of the originating process. For example:

iptables -A OUTPUT -m owner --uid-owner some_user -j DROP

iptables is not able to distinguish between interactive and non-interactive processes. But you might want to look into the Linux CGROUP for this. Specifically, the net_cls subsystem. You can tag packets with the net_cls subsystem, and then filter them with iptables. So the process would be to first put the interactive user's shell in a net_cls cgroup which tags outgoing packets, and then filter those packet's with iptables.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .