![如何正确地让防火墙按组阻止任何应用程序?](https://linux22.com/image/119597/%E5%A6%82%E4%BD%95%E6%AD%A3%E7%A1%AE%E5%9C%B0%E8%AE%A9%E9%98%B2%E7%81%AB%E5%A2%99%E6%8C%89%E7%BB%84%E9%98%BB%E6%AD%A2%E4%BB%BB%E4%BD%95%E5%BA%94%E7%94%A8%E7%A8%8B%E5%BA%8F%EF%BC%9F.png)
阻止我关注的应用程序这,但像:
groupadd nonet
adduser $USER nonet
iptables -A OUTPUT -m owner --gid-owner nonet -j REJECT #put at /etc/rc.local
sudo -k iptables --list |grep nonet #to confirm
#REJECT all -- anywhere anywhere owner GID match nonet reject-with icmp-port-unreachable
测试(重启后):
sg nonet "ping www.google.com" #was blocked
sg nonet "google-chrome" #was able to connect, why?
sg nonet "links2" #was able to connect, why?
# showed all properly being on group nonet
ps --forest -A -o pid,ppid,user,group,cmd |egrep "links|chrome"
因此,它不适用于某些应用程序。
如何让防火墙规则(按组)适用于所有应用程序(使用时sg nonet
)?
PS:这里是ubuntu 16.04