IPTABLES rule using --gid-owner

sJjohn · 03-09-2020, 12:11 PM

I have 2 groups created: groupA groupB
I have 4 users: uA, uB, uC, uD

groupA = uA and uB, groupB = uC and uD.

I am trying to block groupB from accessing OUTSIDE network.
groupA can access.

I want to be able to return the packets once the connection is established.

I tried:

iptables -A OUTPUT -o eth0 -m owner --gid-owner groupA -j ACCEPT
iptables -A OUTPUT -o eth0 -m owner --gid-owner groupB -j REJECT

But this does not work. when I su - uC, I can still ping google.com.
I am a bit confused on the return after established connection rule.

Can anyone please assist.

Turbocapitalist · 03-09-2020, 12:23 PM

Welcome.

Where are these rules in relation to other rules in the OUTPUT chain? The --append or -A option will put these two new rules after any that are already in place. So if one of the previous rules lets everyone out, that's what'll happen. Can you show the whole OUTPUT chain?

sJjohn · 03-09-2020, 12:52 PM

Thank you,
I did not add any rules yet.
Here is the default output chain I see:

[root@c12-19 ~]# iptables -nL
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
[root@c12-19 ~]#

Quote:

Originally Posted by Turbocapitalist

Welcome.

Where are these rules in relation to other rules in the OUTPUT chain? The --append or -A option will put these two new rules after any that are already in place. So if one of the previous rules lets everyone out, that's what'll happen. Can you show the whole OUTPUT chain?

Turbocapitalist · 03-09-2020, 01:06 PM

Ok. That means those would be the only two rules in the chain. Perhaps --gid-owner only addresses primary groups. Have you looked at using --suppl-groups also?

sJjohn · 03-09-2020, 01:19 PM

Thank you,
No I have not tried that before. I did now, here is what I got:

[root@c12-19 ~]# iptables -A OUTPUT -o eth0 -m owner --gid-owner 59931 --suppl-groups groupB -j REJECT
iptables v1.4.21: unknown option "--suppl-groups"
Try `iptables -h' or 'iptables --help' for more information.

[root@c12-19 ~]# iptables -A OUTPUT -o eth0 -m owner --suppl-groups groupB -j REJECT
iptables v1.4.21: unknown option "--suppl-groups"
Try `iptables -h' or 'iptables --help' for more information.

Quote:

Originally Posted by Turbocapitalist

Ok. That means those would be the only two rules in the chain. Perhaps --gid-owner only addresses primary groups. Have you looked at using --suppl-groups also?

Turbocapitalist · 03-09-2020, 02:04 PM

I tried a few things and searched a little but gave up quickly on iptables. Reading about it, there seem to be some longstanding issues about how iptables handles groups. nftables is much better and iptables will be deprecated in the near future so, have you considered nftables instead?

I get the expected behavior with nftables:

Code:

$ nft list ruleset
table ip output {
        chain filter4 {
                type filter hook output priority 0; policy accept;
                ip protocol tcp skgid "groupB" reject                            
        }
}

You'd have to install nftables, uninstall iptables, and then reboot for the new filter interface to take effect.

https://wiki.nftables.org/wiki-nftab....php/Main_Page

sJjohn · 03-09-2020, 02:45 PM

Never tried that.

We were considering iptables for this though.

Quote:

Originally Posted by Turbocapitalist

I tried a few things and searched a little but gave up quickly on iptables. Reading about it, there seem to be some longstanding issues about how iptables handles groups. nftables is much better and iptables will be deprecated in the near future so, have you considered nftables instead?

I get the expected behavior with nftables:

Code:

$ nft list ruleset
table ip output {
        chain filter4 {
                type filter hook output priority 0; policy accept;
                ip protocol tcp skgid "groupB" reject                            
        }
}

You'd have to install nftables, uninstall iptables, and then reboot for the new filter interface to take effect.

https://wiki.nftables.org/wiki-nftab....php/Main_Page

Turbocapitalist · 03-09-2020, 03:16 PM

I wouldn't hold my breath about problems with iptables getting fixed any time soon. That one with the groups seems to be an old one, too.

Myself, I've run into enough problems with iptables that I don't consider it for any projects any more and just use nftables nowadays. Back before nftables, I did recompile some kernels with ipchains support because of problems with iptables. So maybe I just never got along with iptables.

Either way, nftables is the future of packet filters for Linux. So you might give it a quick try. The syntax is quite different from ipchains and iptables, and is a bit more complex. However, the complexity on the user side is supposed to be in exchange for gains in performance once the rules are inside the kernel.

You have two ways of building the rules out:

Code:

nft flush ruleset
nft add table ip foobar

nft add chain foobar input  { type filter hook input priority 0 \; policy drop \; }
nft add rule ip foobar input ct state related,established counter accept

nft add chain foobar output  { type filter hook output priority 0 \; policy accept \; }
nft add rule ip foobar output ip protocol tcp skgid groupb reject

Or

Code:

#!/usr/bin/nft -f

flush ruleset

table ip foobar {
        chain input {
                type filter hook input priority 0; policy drop;
                ct state established,related counter accept
        }

        chain output {
                type filter hook output priority 0; policy accept;
                ip protocol tcp skgid "groupb" reject
        }
}

The latter format is what you can put in /etc/nftables.conf for persistence.

The wiki in the earlier link seems to be the best guide, though the manual page serves as a reminder once it nft becomes familiar.