title: iptables --gid-owner works only for user's main group
body: <p>I am trying to disable access to IP 1.2.3.4 for all users except for members of group &quot;neta&quot;. This is a new group which I created only for this matter.</p>
  <pre><code>iptables -I OUTPUT -o eth0 -p tcp -d 1.2.3.4 -m owner ! --gid-owner neta -j REJECT
  </code></pre>
  <p>This disables access to 1.2.3.4 for all users, even if they are member of group &quot;neta&quot;.</p>
  <p>I have an user xx and he is a member of groups xx (main group) and neta. If I change the rule to:</p>
  <pre><code>iptables -I OUTPUT -o eth0 -p tcp -d 1.2.3.4 -m owner \! --gid-owner xx -j REJECT
  </code></pre>
  <p>everyone except user xx is not able to access 1.2.3.4.</p>
  <p>I added root to this group xx:</p>
  <pre><code>usermod -a -G xx root
  </code></pre>
  <p>but root was still not able to access this IP.If I add main user's group (root, xx) to the rule everything works as expected.</p>
  <p>I tried spliting it in two rules just to be sure (and log rejected):</p>
  <pre><code>iptables -A OUTPUT -o eth0 -p tcp -d 1.2.3.4 -m owner --gid-owner neta -j ACCEPT
  iptables -A OUTPUT -o eth0 -p tcp -d 1.2.3.4 -m limit --limit 2/s --limit-burst 10 -j LOG
  iptables -A OUTPUT -o eth0 -p tcp -d 1.2.3.4 -j REJECT
  </code></pre>
  <p>but there is no difference. Everything is being rejected.</p>
  <p>There are no other iptables rules.</p>
  <pre><code>root@vm1:~# iptables -nvL
  Chain INPUT (policy ACCEPT 19 packets, 1420 bytes)
   pkts bytes target     prot opt in     out     source               destination         
  
  Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
   pkts bytes target     prot opt in     out     source               destination         
  
  Chain OUTPUT (policy ACCEPT 10 packets, 1720 bytes)
   pkts bytes target     prot opt in     out     source               destination         
      0     0 ACCEPT     tcp  --  *      eth0    0.0.0.0/0            1.2.3.4     owner GID match 1001 
      0     0 LOG        tcp  --  *      eth0    0.0.0.0/0            1.2.3.4     limit: avg 2/sec burst 10 LOG flags 0 level 4 
      0     0 REJECT     tcp  --  *      eth0    0.0.0.0/0            1.2.3.4     reject-with icmp-port-unreachable 
  </code></pre>
  <p>I want to be able to (dis)allow access to this IP by adding/removing users from this &quot;neta&quot; group instead of adding iptables rules for every user.</p>