Printable View
Hi
iptables-problem:
How can I open a certain port (say 80) for a certain program only (say Mozilla Firefox)? So that other programs (e.g. Konqueror) are not able to use this port.
sth like:
iptables -A OUTPUT -program ! "Mozilla Firefox" --sport 80 -j DROP
thx xadian
I don't think that is possible...
You have to add to OUTPUT
-m owner --cmd-owner "/path/to/application"
man iptables
owner
This module attempts to match various characteristics of the packet
creator, for locally-generated packets. It is only valid in the OUTPUT
chain, and even this some packets (such as ICMP ping responses) may
have no owner, and hence never match.
--uid-owner userid
Matches if the packet was created by a process with the given
effective user id.
--gid-owner groupid
Matches if the packet was created by a process with the given
effective group id.
--pid-owner processid
Matches if the packet was created by a process with the given
process id.
--sid-owner sessionid
Matches if the packet was created by a process in the given ses-
sion group.
--cmd-owner name
Matches if the packet was created by a process with the given
command name. (this option is present only if iptables was com-
piled under a kernel supporting this feature)
This is missing an important point. The outgoing web browser (i.e. client which attaches to web servers all over the world) does not even use port 80. It uses high-numbered ports. Many web servers use port 80, not clients.
Blocking outgoing port 80 does you no good.
Yes, shure. OnlyQuote:
Originally Posted by anomie
-m owner --cmd-owner "appname"
flags useful in this case.
(I wasn't making the point to you.)
Wouldn't it be easier to just uninstall the applications you dont want people to use?