From: "Elmar Stellnberger" <estellnb@gmail.com>
To: netfilter@vger.kernel.org
Subject: block network access for certain users/groups
Date: Thu, 29 Jul 2010 21:09:51 +0200 [thread overview]
Message-ID: <op.vgmcupy42qajpl@imac.local> (raw)
I need to block network access for certain users/groups, fully:
iptables -A mychain -m owner --gid-owner blockedusergroup -j DROP
...drops ping packages in the output chain but lets my user happily
connect to localhost:631 or any other http address. In deed the rule above
is therefore pretty useless.
I need to block ALL incoming and outgoing packages for a certain
user/group.
At the moment there is only insufficient blocking for outgoing packages
available.
What will I have to do to implement network access restrictions on a per
user/group basis?
Logging such packages is already possible. Why is blocking them not?
Can anyone help me?
Elmar Stellnberger
next reply other threads:[~2010-07-29 19:09 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-07-29 19:09 Elmar Stellnberger [this message]
2010-07-29 19:33 ` block network access for certain users/groups Lars Nooden
2010-07-30 9:00 ` Jan Engelhardt
2010-07-30 11:34 ` Lars Nooden
2010-07-30 20:10 ` Elmar Stellnberger
2010-07-31 5:04 ` Richard Horton
[not found] <AANLkTin8w74SAe67ZPqPE0Q=0fPpZOHnTCnjAT+AduCY@mail.gmail.com>
2010-08-25 11:09 ` Elmar Stellnberger
2010-08-25 11:58 ` Tetsuo Handa
2010-08-26 12:28 ` Tetsuo Handa
2010-08-30 11:36 ` Elmar Stellnberger
2010-08-30 11:55 ` Tetsuo Handa
2010-08-25 16:02 ` Hagen Paul Pfeifer
-- strict thread matches above, loose matches on Subject: below --
2010-07-29 19:09 Elmar Stellnberger
2010-07-29 19:33 ` Richard Horton
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=op.vgmcupy42qajpl@imac.local \
--to=estellnb@gmail.com \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.