Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How do I block a user from accessing the internet under Linux?

I'm trying the following:

iptables -A OUTPUT -p tcp --dport 80,443 -m owner --uid-owner $USERNAME -j DROP

Is that the right syntax or command?

share|improve this question
not being familiar with -m owner you could probably just remove -p tcp --dport 80,443 and prevent ALL tcp/ip access –  xenoterracide Apr 5 '10 at 7:54
If you have control over their access point (e.g. router), you could block their computer's physical addresses and whatnot. –  iglvzx Nov 15 '11 at 0:11
@iglvzx That would block the whole machine, and not a specific user, which is what it looks like was being asked. –  killermist Jun 25 '12 at 3:22

2 Answers 2

And then I do ssh myhost.somewhere.onthe.internet.example.com -D 12345, point my browser to use SOCKS proxy localhost:12345, and on I go on my merry way.

In other words, blacklisting specific ports is not sufficient; you may want to block all network access:

iptables -A OUTPUT -m owner --uid-owner $USERNAME -j DROP

Note that there may be a need to access certain network resources (e.g. local network shares), so you may need to whitelist those (or perhaps whitelist the local network block).

share|improve this answer

This command will only block the user from accessing the World Wide Web, not the entire Internet.

Apart from that it should work, assuming it is run on the same machine $USERNAME is working on.

share|improve this answer
This is correct only for web servers running on standard ports. This is the case for most web servers, but generally a web server can listen on any port. So it's possible for that user to set up a remote web server running on a non-standart port, host a CGI proxy web script there and browse the Internet over it. –  geek Feb 15 '10 at 15:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.