Blocking and unblocking internet access of a running process

Question

Is it possible to block the internet access of a process and then later unblock it while the process is still running?

Answer 1

The answer is "it depends".

1. Does the application access a known set of remote services or use a specific (unique) set of ports? In either case, you can create rules that block only access to those remote addresses or ports.

2. If you start the process in its own network namespace (perhaps with masqueraded access to the outside world), it's very easy to create application-specific rules, because (a) you can create netfilter rules that are local to the namespace and (b) you can create global netfilter rules that refer to the application namespace by ip or device. The most common way of running a process inside its own network namespace is by using a container runtime like Docker or Podman, but you can also do this manually using unshare or ip, both of which are probably already available on your Linuxsystem. Trying to set things up manually can be tricky.

3. If the application is running under a specific user or group id, you may be able to use the iptables owner module to match using those criteria.

Answer 2

You can do that using cgroup2 and iptables. Let's say you want to block all network access (including loopback) to the firefox process.

# CGROUP_MOUNT_POINT=/sys/fs/cgroup

create cgroup

# mkdir $CGROUP_MOUNT_POINT/disable-network

add iptables rule to disable network access from cgroup

# iptables -A OUTPUT -m cgroup --path disable-network/ -j REJECT

add firefox processes to created cgroup

# for pid in $(pidof firefox); do echo $pid > $CGROUP_MOUNT_POINT/disable-network/cgroup.procs; done

remove firefox processes from cgroup, moving them to root cgroup

# for pid in $(pidof firefox); do echo $pid > $CGROUP_MOUNT_POINT/cgroup.procs; done

But this has some pitfalls. It's difficult to manage cgroups manually, also existing sockets won't be associated with the new cgroup. You may prefer to manage cgroups with systemd, using slices and systemd-run, and persistent iptables rules.

Answer 3

Not per-process, but you can shutdown the network on your machine and bring it back any time you want. But that would be for all applications running.

For example, you can stop and start a network card eth0 (which is a default name for wired network)

# ifconfig eth0 down
# ifconfig eth0 up

or all network interfaces simultaneously:

# /etc/init.d/network stop
# /etc/init.d/network start
   - or depending on OS that can be
# service network stop 
# service network start

Of course, such commands requires root's access, so either switch to it, or sudo.