How to limit port 80 to just one user with iptables

Question

I want to limit port 80 so that only one user can use it. I want to do this with iptables I have not found any documentation on how to do this.

Answer 1

If you mean "a local user with a discrete uid" then you can use the owner module (-m owner) and the --uid-owner # option.

But there are some problems here:

1. This only works on outbound packets.
2. Some packets don't have owners.

By themselves, those might not normally be deal-breakers. But you need to effectively invert the conditional and block packets not matching the user. I suspect this will sufficiently break protocol processing that a simple attempt to do this will fail.

I would say, forward port 80 output that you know will have a user association to a separate chain, and then filter only that chain by user. This should sufficiently break other user's traffic but not internal traffic to generally meet your requirement.

Answer 2

iptables has the -m owner --uid-owner ### match which "Matches if the packet was created by a process with the given effective user id"