Tobias/No-Internet.Group
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
Tobias
2026-06-07 12:01:48 +01:00
parent 0d4583e887
commit cd0bde7109
1 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
README.md
View File

@@ -1,7 +1,7 @@
# No-Internet Group
## Description
Simple minimalistic methodology to prevent specified Linux programs having access to the public Internet via iptables
Simple and minimalistic methodology to prevent specified Linux programs having access to the public Internet via iptables
## Workflow
@@ -43,7 +43,7 @@ To check run
``` bash
groups $(whoami)
```
Your user will need to be a member of the group as we will run the programs through sg
Your user will need to be a member of the group as the programs will be ran via sg
### Creating the Systemd Service
Next we will create a systemd service which uses iptables to drop outbound connections made by the "no-internet" group
@@ -77,13 +77,13 @@ Breakdown of iptables command:
- the -j DROP flag specifies the action to take, in this case dropping the packets
Next we will reload our systemctl services, and enable no-internet so it persistently starts at boot
Next we will reload our systemctl services, and enable the no-internet unit so it persistently starts at boot
``` bash
systemctl daemon-reload
systemctl enable --now no-internet.service
```
Note: a similar effect could be achieved via cron by making an entry along the lines of
Note: a similar effect could be achieved with cron by making an entry along the lines of
``` bash
@reboot root iptables -I OUTPUT 1 -m owner --gid-owner "no-internet" -j DROP
```
@@ -91,7 +91,7 @@ Note: a similar effect could be achieved via cron by making an entry along the l
.desktop files are used within graphical Linux shells to launch programs
Simply put when a program is ran through an application launcher the .desktop file is what is what is being read from and executed in the background
Simply put, when a program is ran through an application launcher the .desktop file is what is what is being read from and executed in the background
They are typically located within ~/.local/share/applications
@@ -107,9 +107,9 @@ This may be achieved by changing the line like so:
``` bash
Exec=/usr/bin/sg no-internet -c /usr/bin/lutris
```
Note: your binaries may be located in a different place, type "which [program_name]" or "type [program_name]" into the terminal to find their path
Note: your binaries may be located in a different place, type ``` which [program_name] ``` or ``` type [program_name] ``` into the terminal to find their path
Now any time lutris is launched from my desktop it will be ran through the "no-internet" group
Now any time Lutris is launched from my desktop it will be ran through the "no-internet" group
### Usage Examples
@@ -122,4 +122,4 @@ Desktop example:
![picture](https://git.tobiastime.xyz/Tobias/No-Internet.Group/raw/branch/main/images/Screenshot_20260311_203001.webp)
### Limitations
As iptables is operating at layer 3 programs ran through this sandboxed group will still be able to reach devices within the same broadcast domain
As iptables is operating at layer 3 of the OSI model programs ran through this sandboxed group will still be able to reach devices within the same broadcast domain