Is it possible to simulate "no external access" from a Linux machine when developing?

Question

Sometimes I upload an application to a server that doesn't have external internet access.

I would like to create the same environment in my machine for testing some features in the application and avoid bugs (like reading a rss from an external source).

I thought about just unplugging my ethernet cable to simulate, but this seems archaic and I don't know if I'm going to raise the same exceptions (specially in Python) when doing this compared to the limitations at the server.

So, how do I simulate "no external access" in my development machine? Will "deactivating" my ethernet interface and reactivating later (with a "no hassle" command) have the same behavior as the server with no external access?

I'm using Ubuntu 10.04. Thanks!

Answer 1

Deleting the default route should do this. You can show the routing table with /sbin/route, and delete the default with:

sudo /sbin/route del default

That'll leave your system connected to the local net, but with no idea where to send packets destined for beyond. This probably simulates the "no external access" situation very accurately.

You can put it back with route add (remembering what your gateway is supposed to be), or by just restarting networking. I just tried on a system with NetworkManager, and zapping the default worked fine, and I could restore it simply by clicking on the panel icon and re-choosing the local network. It's possible that NM might do this by itself on other events, so beware of that.

Another approach would be to use an iptables rule to block outbound traffic. But I think the routing approach is probably better.

Answer 2

You wrote

So, how do I simulate "no external access" in my development machine?

How do I "deactivate" my ethernet interface and reactivate later with no hassle?

Are these two questions or one question? I'm not sure what you mean by simulate "no external access". However, to deactivate the ethernet interface you could simply do

#ifdown eth0
#ifup eth0

or whatever your internet device is. This will bring your ethernet interface down and up, respectively.

Answer 3

You could run your code in a virtual machine (User Mode Linux, VServer, OpenVZ, VirtualBox, VMWare, KVM, …) that you provide with only a host-only network interface (i.e. no routing from the VM to anywhere but the host machine).

If you run the application as a dedicated user appuser, you can restrict that user's network access. Make sure you have iptables (Ubuntu: iptables Install iptables http://bit.ly/software-small) and iproute2 (ip command) (Ubuntu: iproute Install iproute http://bit.ly/software-small, iproute-doc Install iproute-doc http://bit.ly/software-small) installed. Then you can use iptables to mark outgoing traffic from processes running as appuser, and ip rule and ip route to set up an alternate routing table for that user.

ip rule add fwmark 1 table 1
ip route add 127.0.0.0/0 table 1 dev lo
iptables -t mangle -A OUTPUT -m owner --uid-owner appuser -j MARK --set-mark 1

(Note: untested. See also more Linux IP packet mangling examples.)

Answer 4

This is what containers are for ( https://linuxcontainers.org/ ) they are a bit like chroot, but finer grained, and have network control, and other things, as well.

Unfortunately I have no idea how to use them. (My training only went as for as knowing they exist, and roughly what they do.)

docker is an application that manages containers, you do not want to do it manually.