Block Outgoing Network Access For a Single User Using Iptables

Iptables has a special module called owner (ipt_owner), which is attempts to match various characteristics of the packet creator, for locally generated packets. It is valid in the OUTPUT and POSTROUTING chains.

This is quite useful if you like to block a user within your Linux server to have network access then you can use owner module to match user and block all outgoing traffic for that user. For example, user oracle can connect to oracle database server (using ssh) but not allowed to all outgoing traffic. On other hand user, admin should allow to connect outside network to download updates from RHN or Oracle site. This is nifty module and I use extensively to restrict outgoing access to certain users.

Syntax:

iptables -A OUTPUT -o ethX -m owner --uid-owner {USERNAME} -j DROP

OR

iptables -A OUTPUT -o ethX -m owner --uid-owner {USERNAME} -j REJECT

OR

iptables -A OUTPUT -o ethX -m owner --uid-owner {USERNAME} -j REJECT

OR

iptables -A OUTPUT -o ethX -m owner --uid-owner {USERNAME} -j ACCEPT

Where,

• –uid-owner { USERNAME } : Matches if the packet was created by a process with the given effective USERNAME.
• -A : Append rule to given table/chain
• -I : Insert rule to head of table/chain

For example, my oracle user id is 1000 so I will append following rule:

/sbin/iptables -A OUTPUT -o eth0 -m owner --uid-owner 1000 -j DROP
service iptables save

Example: Block Apache User Making Outgoing Connections

Use the following iptables based configuration to block all outgoing connections made by Apache user. This blocks hackers downloading code into your server using wget or any other tools:

iptables --append OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
 
# create a new chain
iptables --new-chain chk_apache_user
 
# use new chain to process packets generated by apache
iptables -A OUTPUT -m owner --uid-owner apache -j chk_apache_user
 
# Allow 143 (IMAP) and 25 so that webmail works :)
iptables -A chk_apache_user -p tcp --syn -d 127.0.0.1 --dport 143 -j RETURN
iptables -A chk_apache_user -p tcp --syn -d 127.0.0.1 --dport 25  -j RETURN
 
# reject everything else and stop hackers downloading code into our server
iptables -A chk_apache_user -j REJECT

Add/modify above code to your existing firewall script. This module also support following options:

• –gid-owner {groupid}: Matches if the packet was created by a process with the given effective group id.
• –pid-owner {processed}: Matches if the packet was created by a process with the given process id.
• –sid-owner {sessionid}: Matches if the packet was created by a process in the given session group.
• –cmd-owner {name} : Matches if the packet was created by a process with the given command name.

Please note that that some packets (such as ICMP ping responses) may have no owner (or suid based program), and hence never match. Also for some options, you may need to recompile kernel. On Red Hat Enterprise Linux and Debian default kernel has support for owner module.