Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

There are tons of native Linux tools for monitoring network access: iftops, nethogs and more.

To block network access: firejail, unshare, or ip-nets jail if you like to get your hands dirty.

To limit bandwidth you can use trickle, wondershaper or again use ip tools.

If you don't mind some work SELinux can do this and so does AppArmor which is probably already included in your distro.



Which of them gives an easy application targeted firewall? Something like iptables doesn't operate with application abstraction.


Firejail is dead simple.

Note that Linux has application firewalling built in as part of kernel namespaces.

Edit: forgot to add, new application containers such as snap have a built in system for this and more - just like how its done on phones.


Could you post an example of using SELinux to allow/deny connections per application/ip/domain/port/uid/application path in an interactive manner?


A question that comes to mind reading this. Is it possible to block/limit outbound traffic of a docker-container?

I'm thinking of a situation where I want to run a precompiled binary, but only want it to talk to an other container and not the outside world. How would I do that?


To disable completely

    docker run --network=none x
Local only

    docker network create --internal int1
    docker run --network=int1 x


There are tons of native Linux tools for monitoring network access

yes, and not many of them allow inspection on the level that i am interested in.

for example, counting bandwith per interface when i really care about speed and accumulated bandwith that goes the ISP.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: