title: iptables script to block all internet access except for desired applications
body: <p><strong>CONTEXT:</strong></p>
  
  <p>I wanted to have a shell script that would block all Inbound/Outbound traffic to my computer, UNLESS I decide I want to use the browser or some other application, in which case I would summon it and only those applications would run.</p>
  
  <p>I have researched previous scripts made by smart individuals (links to sources at the end), as well as invested the time to learn to use iptables myself (still working on this front). </p>
  
  <p>Here is the result of the work done:</p>
  
  <p><strong>RESULTS:</strong></p>
  
  <p>before the shell script is run, a group called <strong>internet</strong> is created:</p>
  
  <p><code>sudo groupadd internet</code></p>
  
  <p>Shell Script:</p>
  
  <pre><code>#!/bin/sh
  #only allow apps run from "internet" group to run
  
  # clear previous rules
  sudo iptables -F
  
  # accept packets for internet group
  sudo iptables -A OUTPUT -p tcp -m owner --gid-owner internet -j ACCEPT
  sudo iptables -A OUTPUT -p udp -m owner --gid-owner internet -j ACCEPT
  
  # also allow local connections
  sudo iptables -A OUTPUT -p tcp -d 127.0.0.1 -j ACCEPT
  sudo iptables -A OUTPUT -p tcp -d 192.168.0.1/24 -j ACCEPT
  
  # reject packets for other users
  sudo iptables -A OUTPUT -j REJECT
  
  # same process for IPv6:
  sudo ip6tables -A OUTPUT -p tcp -m owner --gid-owner internet -j ACCEPT
  sudo ip6tables -A OUTPUT -p udp -m owner --gid-owner internet -j ACCEPT
  sudo ip6tables -A OUTPUT -p tcp -d 127.0.0.1 -j ACCEPT
  sudo ip6tables -A OUTPUT -p tcp -d 192.168.0.1/24 -j ACCEPT
  sudo ip6tables -A OUTPUT -j REJECT
  </code></pre>
  
  <p>this is the other part of the shell that I'm currently working on and not 100% confident with:</p>
  
  <pre><code>#DROPS ALL INPUT and FORWARD
  sudo iptables -A INPUT -j DROP
  sudo iptables -A FORWARD -j DROP
  
  #ONLY ACCEPTS INPUT THAT WAS INITIATED BY SOME OUTPUT
  sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
  
  #SAME REPEATED FOR IPv6
  sudo ip6tables -A INPUT -j DROP
  sudo ip6tables -A FORWARD -j DROP
  sudo ip6tables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
  </code></pre>
  
  <p>after the whole script above is executed, the following command would open a terminal that would be part of the <code>internet</code> group, and hence any application (like firefox for instance) that were open by that terminal would have internet access, while all other INPUT/OUTPUT would be stopped</p>
  
  <pre><code>sudo -g internet -s
  </code></pre>
  
  <p><strong>QUESTION:</strong></p>
  
  <p>Is the previous logic in order? Currently I am working on testing out all the features, by installing network monitoring software (nethogs), testing each line of code and seeing if the result is as expected, <strong>BUT</strong> at the same time, I only started learning about iptables 2 days ago, so even though the sources of the original code is done by experienced coders, I am not 100% confident in my ability to put it all together to produced the desired result. <strong>Thanks</strong> to anyone who took the time to read all this and participate in the discussion <strong>!!!</strong></p>
  
  <p>sources:</p>
  
  <p><a href="https://plus.google.com/+TobyKurien/posts/YZhZJCZmGgm" rel="nofollow noreferrer">https://plus.google.com/+TobyKurien/posts/YZhZJCZmGgm</a>
  <a href="https://serverfault.com/questions/429400/iptables-rule-to-allow-all-outbound-locally-originating-traffic">https://serverfault.com/questions/429400/iptables-rule-to-allow-all-outbound-locally-originating-traffic</a></p>
  
  <p><em>P.S.: Thanks to @dirkt for previously helping me understand a lot of the fundamental concepts of iptables as well as answering some of my questions regarding the source code.</em></p>
  
  <hr>
  
  <p><strong>UPDATE:</strong></p>
  
  <p>So after having run the code, there seems to be something wrong. What happens is as follows. I run the shell script:</p>
  
  <pre><code>bash myscript
  </code></pre>
  
  <p>I get 2 errors as follows:</p>
  
  <blockquote>
    <p>ip6tables v1.6.0: host/network <code>127.0.0.1</code> not found
    Try `ip6tables -h' or 'ip6tables --help' for more information.</p>
    
    <p>ip6tables v1.6.0: host/network <code>198.168.0.1</code> not found
    Try `ip6tables -h' or 'ip6tables --help' for more information.</p>
  </blockquote>
  
  <p>but everything else ran well, and when doing <code>sudo iptables -L</code> I did confirm all the other rules are in place. <strong>AFTER</strong> that, I tried the following:</p>
  
  <ul>
  <li>Run firefox by manually double-clicking the icon. The result was as expected, right away I got a <strong>Server not found</strong> error, which was a good sign</li>
  <li>After that I ran the command <code>sudo -g internet -s</code> in the terminal, and then <code>firefox</code>. <strong>NOW...</strong> when I tried loading a website, it didn't show me <em>Server not found</em>, but it keep loading for a long period of time, very long. This leads me to believe that maybe the output response was sent, BUT the input was being blocked. </li>
  </ul>
  
  <p><strong>If anyone knows why this might be happening, I would love to know your feedback!</strong></p>