Firewall to block all internet activity except specific packages/programs [duplicate]

Question

is anyone aware of a firewall which can block all internet activity in an ubuntu installation but allow specific packages and programs to use internet with a checkbox list provided by a GUI ?

thank you

Answer 1

A firewall called UFW ( Uncomplicated Firewall ) is already installed on Ubuntu by default. However, if what you need is a GUI to manage it graphically instead of via command-line in the terminal you can install gufw package.

To install it, run the following command in the terminal:

sudo apt install gufw

To run it, search applications for gufw and click on it or type and run in the terminal:

gufw

Then you will be presented with an easy to use graphical interface to manage your firewall.

Please note:

If you are running Ubuntu on Wayland, the GUI will not work. To solve this, please log out and before entering your password in the login screen click on the small gear icon next to the password field and chose Ubuntu NOT Ubuntu on Wayland. Type your password, login and it will work.

Answer 2

You should be able to achieve this using iptables and groups.

What you can do is create rule to block all internet traffic for your user account, and then whitelist specific applications by running them as a different group.

Create a rule to block all internet traffic from your user account:

sudo iptables -I OUTPUT 1 -m owner --gid-owner $USER -j DROP

Test this by pinging something or trying to browse to a website. The connection should be blocked.

Then, create a separate group called allow-network:

sudo addgroup allow-network

Add your user to the group:

sudo adduser $USER allow-network

Then, to allow an application to access the internet, launch it under the allow-network group using sg. For example:

sg allow-internet firefox

The iptables configuration will not survive a reboot, so you'll need to make sure these rules are run each time. For example by adding them as a startup script or in cron as @reboot.