I wish to prevent some programs from "phoning home", and to allow other programs to access only specific web servers.

Is there any way to interactively allow or decline outbound communication from individual programs on Ubuntu?

  • This question on the Unix StackExchange suggests some interactive programs, such as OpenSnitch and Douane. I think that's the sort of thing you are looking for (were looking for 12 years ago!) May 23, 2022 at 10:09

4 Answers 4


That would be netfilter/ipfilter with some script that would do things interactively (maybe with the nice API available on Ubuntu) using a background scripting.

There is some old discussion at this UbuntuForums page.
Also see, Ubuntu IPTablesHowTo and Firewall pages.


You could give Anoubis a try. There are installation instructions and packages for Karmic Koala available (I'm new to superuser, so you'll have to find them yourself >:-S Hint: on the Download page scroll down to "Distributions").


Well not exactly interactive but I know about 3 ways to restrict network access to programs.

  1. By default linux assigns permissions to users and every program they run has the same permissions. Run the untrusted program as a separate user. This is pretty simple if you can do it. (Sometimes you can't like when a program requres root privileges.) Add the following firewall rule:

    iptables -A OUTPUT -m owner --uid-owner ${untrusted_uid} -j DROP
  2. If you are not afraid of patching the kernel try grsecurity. It allows different permissions for different executables for the same user. This is probably the best way because you can integrate it with iptables rules and specify detailed restrictions. The rules should look something like:

    role your_regular_user u
        subject /path/to/untrusted/program
            connect disabled
  3. Disable the connect() function with LD_PRELOAD. This is the ugliest way only use it if you have no other option. You will need a library like this:

    #include <errno.h>
    #include <stdio.h>
    #include <sys/types.h>
    #include <sys/socket.h>
    int connect(int sockfd, struct sockaddr const* addr, socklen_t addrlen) {
        errno = ECONNREFUSED;
        printf("connection refused\n");
        return -1;

    Compile this with

    gcc -fPIC -shared -Wl,-soname,fake_connect fake_connect.c -o libfake_connect.so

    Start the program with

    LD_PRELOAD="./libfake_connect.so" ./untrusted_program

I had been using gufw for some time, it's nice and easy to install/configure. gufw doesn't come with Ubuntu installations. You have to install it manually 'sudo apt-get install gufw'.

Here are some of the references.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .