You can do that with
On a terminal add the rule to
sudo iptables -A OUTPUT -p all -m owner --uid-owner username -j DROP
where username is the user that you want to disable the Internet connection. Save the file and exit.
This will add a rule to
iptables saying that any outgoing packages created by the specified user will be automatically dropped by
If you want to do the same for a complete group I sugest that instead of
--uid username you use
--gid-owner groupname, that will have the same effect for a complete user group.
So to prevent the group Security from accessing the Internet the command would look something like this
sudo iptables -A OUTPUT -p all -m owner --gid-owner security -j DROP
To make the rule permanent you can create a script in
/etc/network/if-up.d/, add the necessary lines to it and make it executable.
As an option use
iptables-save to save your current rules and restore them on boot.
Save the current
sudo iptables-save > /etc/iptables_rules
/etc/rc.local with your favorite text editor and at the end of the file add
/sbin/iptables-restore < /etc/iptables_rules
That will restore the saved rules on each boot.
For more information visit the [
iptables manpage] page for more information on several