Home / server / Questions / 1069763
In Process
kittygirl
Asked: 2021-07-16 19:35:28 +0800 CST

How to block network connection to all `root` process?

  • 772

My system is debian 10 with nftables.
output of nethogs as below:

? root     192.168.2.10:59100-172.217.27.138:443 
? root     192.168.2.10:59086-172.217.27.138:443 
? root     192.168.2.10:59082-172.217.27.138:443 
? root     192.168.2.10:59062-172.217.27.138:443 
? root     192.168.2.10:59058-172.217.27.138:443 
? root     192.168.2.10:59054-172.217.27.138:443 
? root     192.168.2.10:59030-172.217.27.138:443 
? root     192.168.2.10:59026-172.217.27.138:443
? root     192.168.2.10:42314-27.19.249.194:443  
? root     192.168.2.10:49788-216.58.200.234:443

I ss -pl | grep 59100 but got nothing,then I plan to block all root process to network connection.
How to do it?

networking nftables

1 Answers

  1. With iptables, this would be rather easy with the owner match extension:

    sudo iptables -A OUTPUT -p all -m owner --uid-owner 0 -j DROP

    Likewise, nftables has matching by socket UID / GID:

    sudo nft add rule filter output meta skuid 0 counter
    • 2