LinuxQuestions.org - Now to block all in/out traffic? (except for Palemoon)

A couple of suggestions from me (not complete solutions)...

1) It is possible to construct an iptables rule to drop all traffic apart from a given group (gid) such that palemoon could still access the internet. For example, create the group "internet-group" and iptables similar to the following...

Code:

iptables -P INPUT DROP 

iptables -P OUTPUT DROP

iptables -P FORWARD DROP

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A OUTPUT -m owner --gid-owner internet-group -j ALLOW

You would need to execute palemoon with the sg command (or make a desktop shortcut)...

Code:

sg internet-group palemoon

2) Not application-specific, but just block all traffic except for web-traffic. For example...

Code:

iptables -P INPUT DROP

iptables -P OUTPUT DROP

iptables -P FORWARD DROP

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A OUTPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT

iptables -A OUTPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT

3) Have look at using OpenSnitch (application-level firewall) in addition to your kernel-based firewall....

https://linuxsecurity.expert/tools/opensnitch/
https://itsfoss.com/opensnitch-firewall-linux/
https://www.linuxuprising.com/2018/0...plication.html