Linux Firewall Tip

Suppose you wish to only allow a certain program access to a certain range of IP addresses.
Unfortunately, the facility to create firewall rules for a specific program, as is readily available in Windows, no longer exists in recent linux kernels.
So, in order to do this, you must create a new user to run the program as.

Use your distribution's user configuration tool to create a new user.
On Fedora, that means running "system-config-users", or choosing "Users and Groups" from the Administration menu.
Make a note of the User ID number of the newly created user. In this example, I'll use 501. Replace 501 with your user ID number in all the examples below.
Now we need to configure the linux firewall, iptables, to only allow this user access to certain IP addresses.
This requires adding rules to the OUTPUT chain. You can do this by running the following commands, which will require root privileges

/sbin/iptables -A OUTPUT -m owner --uid-owner 501 -d 137.205.0.0/16 -j ACCEPT
/sbin/iptables -A OUTPUT -m owner --uid-owner 501 -d 127.0.0.1 -j ACCEPT
/sbin/iptables -A OUTPUT -m owner --uid-owner 501 -j REJECT

The order of the rules is important. The first two rules allow connections to be made to 137.205.*.* and localhost, the third rule blocks all other connections. This is because when a connection attempt is made, the first rule it matches will be the one used, so the accept rules must be before the reject rule.

Check the rules have been entered correctly. You can see your current firewall configuration by running (as root)

/sbin/iptables -L -v -n

You should see entries like this:

Chain OUTPUT (policy ACCEPT 74M packets, 110G bytes)

pkts	bytes	target	prot	opt	in	out	source	destination
41M	61G	ACCEPT	all	--	*	*	0.0.0.0/0	137.205.0.0/16	OWNER UID match 501
26408	1488K	ACCEPT	all	--	*	*	0.0.0.0/0	127.0.0.1	OWNER UID match 501
15216	920K	REJECT	all	--	*	*	0.0.0.0/0	0.0.0.0/0	OWNER UID match 501 reject-with icmp-port-unreachable

(The exact numbers of packets and bytes transferred that you see will vary from the example shown.)

Test the firewall rules.
Open a terminal and switch to the restricted user you created using "su username".
Then try and download a webpage, for example try running "wget http://www.bbc.co.uk/"
The attempt should fail with a "Connection refused." error message, while the attempt will succeed if you try it when logged in as your usual user.
Make the changes permanent.
On Fedora, this can be done by adding the following lines to /etc/sysconfig/iptables, below the other lines but above the COMMIT line.

-A OUTPUT -m owner --uid-owner 501 -d 137.205.0.0/16 -j ACCEPT
-A OUTPUT -m owner --uid-owner 501 -d 127.0.0.1 -j ACCEPT
-A OUTPUT -m owner --uid-owner 501 -j REJECT

Note that if you subsequently use your distribution's firewall configuration tool, you will lose the custom changes.
It may be simplest to make a small shell script, containing the commands to configure the firewall, and run the script each time you boot linux.

Example script: (it's the same as the commands you entered in step 2)

#!/bin/bash
/sbin/iptables -A OUTPUT -m owner --uid-owner 501 -d 137.205.0.0/16 -j ACCEPT
/sbin/iptables -A OUTPUT -m owner --uid-owner 501 -d 127.0.0.1 -j ACCEPT
/sbin/iptables -A OUTPUT -m owner --uid-owner 501 -j REJECT

You may be able to make these commands automatically run each time linux boots by putting them in the /etc/rc.d/rc.local script.

Disclaimer

I do not in any way support the use of p2p on campus or would suggest ways to use the internet there against the AUP.
You use the information in this guide entirely at your own risk.