How do I block a user from accessing the internet under Linux?
I'm trying the following:
iptables -A OUTPUT -p tcp --dport 80,443 -m owner --uid-owner $USERNAME -j DROP
Is that the right syntax or command?
This command will only block the user from accessing the World Wide Web, not the entire Internet.
Apart from that it should work, assuming it is run on the same machine
And then I do
In other words, blacklisting specific ports is not sufficient; you may want to block all network access:
Note that there may be a need to access certain network resources (e.g. local network shares), so you may need to whitelist those (or perhaps whitelist the local network block).
First of all
To find out the tables already in place and the default policy if no rules are matched use
Also, check your init implementation if there are init scripts available to make your changes persistent over power cycles. (Normally your tables are lost after reboot).
Just create a script to include all your iptables commands:
See this article for more tips on standard iptable rules.
Now to answer your question
First we needed to make sure you have a basic firewall up and running. Now, you can add your rule to your script to take effect. Please take in account suggestions from the other answers: an user can easily by-pass two blocked ports with a proxy or alternate ports.
Furthermore, your syntax was not correct. --dport can use only one port. You need to use the multi port module or chain multiple rules to do so.
However, blocking all outgoing connections for this user, will cause many applications to fail because they depend on the lo connection located at localhost or 127.0.0.1. (Eg. if you are using KDM/KDE, your system freezes up during login.)
So you need to exclude the lo network interface from your rule. If still you want to allow the user to access only certain services, just create a rule before the DROP rule allowing those ports. I would suggest the following: