Rational:
Some programs like to access the Internet on their own. For example, many Windows programs I run in wine "call home", and Rhythmbox accesses Amazon each time I play a new MP3 in order to try and download cover art. For privacy purposes, you may want to run a program but ensure it *cannot* access the Internet.
Howto: (6 steps) - Tested and works with Ubuntu 9.04 to 10.04 (see below for 10.10 adjustments)
Step 1. Create a group called "no-internet" and add your user as a member of this new group.
(System->Administration->Users and Groups)
Step 2. Create a script (somewhere in your PATH) called "ni" (stands for No Internet) as follows:
Code:
sudo nano /usr/bin/ni
with this contents:
Code:
#!/bin/bash
sg no-internet "$1"
And make it executable:
Code:
sudo chmod +x /usr/bin/ni
Step 3. Create a script called iptables_no-internet_rule as follows:
Code:
sudo nano /etc/network/if-pre-up.d/iptables_no-internet_rule
with this contents:
Code:
#!/bin/bash
iptables -A OUTPUT -m owner --gid-owner no-internet -j DROP
And make it executable:
Code:
sudo chmod +x /etc/network/if-pre-up.d/iptables_no-internet_rule
Step 4. Enable the new firewall settings you made above in step 3 by running the following command:
Code:
sudo /etc/network/if-pre-up.d/iptables_no-internet_rule
Step 5. Logout and then log back in again to make the group permissions take effect.
Step 6. Finished. You can now run any program without allowing that program to access the network by using this command:
Examples:
- Note: the quotes around the program name are only there to allow you to enter commands needing parameters.
Code:
ni "ping www.google.com"
ni "wine install.exe"
ni firefox
will all run but fail to access the Internet because ping, wine, and firefox are run using the ni script as the group no-internet, which has been barred from outputting anything to other networks. Note: if you are just running a single word command like firefox you don't need the quotes. Also note, for testing, make sure firefox isn't already running because then it will already have Internet access. Close it first and then run it preceeded by ni.
Options:
Local network access
The above will actually prevent all outgoing network access by the programs run with ni; however, sometimes this may not be what you want. For example, certain local network access for games in wine might be acceptable. If you want to allow only local network access but still keep the Internet in general blocked, you can change the iptables config line in the file mentioned in Step 3 to the following:
Code:
iptables -A OUTPUT -m owner --gid-owner no-internet -d ! 192.168.0.0/24 -j DROP
change the 192.168.0.0 to match your local network as required.
Preventing the need for the quotes
Ubuntu 10.10
Uncomplicated Firewall (UFW)
In post #30 of this thread, user zzarko posted a technique that prevents the need for the quotes around the command run by ni, which may be useful when you want to have a script update the parameters of the command. He also described some adjustments for running this on Ubuntu 10.10, which user Jack Brown later confirmed also helps use the same idea with UFW (see post #40).
Revert all changes:
The above changes will persist even after system reboot so you can always run any program with the "ni" script to prevent it from getting out on the network. However, if you no longer want to have this feature enabled, you can uninstall the above by simply removing the two files created like this:
Code:
sudo rm /usr/bin/ni
sudo rm /etc/network/if-pre-up.d/iptables_no-internet_rule
and then remove the group "no-internet" from (System->Administration->Users and Groups).
I hope this helps others.
Adv Reply
Originally Posted by Voorhees1979
Bookmarks