[gentoo-user] Re: How to hide a network interface from an application

[Grant Edwards]

On 2020-08-14, Alexey Mishustin <shumkar@×××××××.ru> wrote:

> Isn't this classic option suitable?
>
> groupadd noinet
> usermod -a -G noinet <your_user>
> iptables -A OUTPUT -i <some_interface> -m owner --gid-owner noinet -j DROP
>    and calling not
> Plex
>    but
> sg noinet Plex
>    (or whatever name the binary has)

Thanks for the suggestion!

[For posterity's sake, with -A Output it's -o <interface> rather than
-i <interface>]

Yes, I think that should work.  I had forgotten (or never knew?) that
iptables rules could trigger on the uid or gid of the process that
sent the packet.  The Plex media server already runs in its own
user/group -- something I should have mentioned in my original post,
since it means that "from a user" instead of "from an application"
would also work. My original post also said I was trying to hide an
interface, when all I really needed was to prevent sending of packets
on that interface.

I think this should work, but I need to rebuild my kernel with the
iptables "owner" extension enabled:

  iptables -A OUTPUT -o <interface> -m owner --uid-owner plex -j DROP

I was just about to start experimenting with ipvlan and network
namespaces, but an iptables rule triggering on uid looks much much
easier.

--
Grant