[GH-ISSUE #3439] How to block all internet except 127.0.0.1 localhost

gitea-mirror commented

2026-05-05 08:50:21 -06:00

Owner

Originally created by @hiBrett on GitHub (May 28, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3439

Is there any way to block a sandboxed program from all internet access except specifically allow access to 127.0.0.1 localhost?

I'm working on having a node.js server run side by side with a sandboxed program, and I want them to communicate.

The documentation mentions adding a bridge under 4.2 Routed Network Setup, but I don't understand how to make that work for this purpose, or if it would work for this purpose.

Relates to:

#108

Originally created by @hiBrett on GitHub (May 28, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3439 Is there any way to block a sandboxed program from all internet access except specifically allow access to 127.0.0.1 localhost? I'm working on having a node.js server run side by side with a sandboxed program, and I want them to communicate. The [documentation](https://firejail.wordpress.com/documentation-2/basic-usage/) mentions adding a bridge under 4.2 Routed Network Setup, but I don't understand how to make that work for this purpose, or if it would work for this purpose. Relates to: * #108

gitea-mirror

2026-05-05 08:50:21 -06:00

closed this issue
added the
networking

duplicate
labels

gitea-mirror commented

2026-05-05 08:50:23 -06:00

Author

Owner

@ghost commented on GitHub (May 28, 2020):

Is there any way to block a sandboxed program from all internet access except specifically allow access to 127.0.0.1 localhost?

Have you tried the --net=none option? Or --protocol=unix if the former crashes the application. If either of those does what you want, you can put the relevant option into a foo.local file, which (1) you will have to create and which (2) uses a slightly different syntax: net none or protocol unix.

@ghost commented on GitHub (May 28, 2020): > Is there any way to block a sandboxed program from all internet access except specifically allow access to 127.0.0.1 localhost? Have you tried the `--net=none` option? Or `--protocol=unix` if the former crashes the application. If either of those does what you want, you can put the relevant option into a foo.local file, which (1) you will have to create and which (2) uses a slightly different syntax: `net none` or `protocol unix`.

gitea-mirror commented

2026-05-05 08:50:24 -06:00

Author

Owner

@rusty-snake commented on GitHub (May 28, 2020):

FWIW: #108

There are two ways bridge (net) or iptables (netfilter).

@glitsj16 net=none has its own lo interface, and therefore its own 127.0.0.1. and protocol unix break IPv4/Ipv6 sockets.

@rusty-snake commented on GitHub (May 28, 2020): FWIW: #108 There are two ways bridge (`net`) or iptables (`netfilter`). @glitsj16 `net=none` has its own `lo` interface, and therefore its own 127.0.0.1. and `protocol unix` break IPv4/Ipv6 sockets.

gitea-mirror commented

2026-05-05 08:50:25 -06:00

Author

Owner

@rusty-snake commented on GitHub (Sep 1, 2020):

I'm closing here due to inactivity, please fell free to request to reopen if you have more questions.

@rusty-snake commented on GitHub (Sep 1, 2020): I'm closing here due to inactivity, please fell free to request to reopen if you have more questions.

gitea-mirror commented

2026-05-05 08:50:26 -06:00

Author

Owner

@jgsch commented on GitHub (Jun 21, 2021):

@rusty-snake

net=none has its own lo interface, and therefore its own 127.0.0.1

it means, for example, the adress 127.0.0.1:9095 does not point to the same thing if I am in a firejail or not? If yes, so I need to use --netfilter to make a bridge between 127.0.0.1:9095 (host) and 127.0.0.1:9095 (firejail)?

@jgsch commented on GitHub (Jun 21, 2021): @rusty-snake > net=none has its own lo interface, and therefore its own 127.0.0.1 it means, for example, the adress `127.0.0.1:9095` does not point to the same thing if I am in a firejail or not? If yes, so I need to use `--netfilter` to make a bridge between `127.0.0.1:9095` (host) and `127.0.0.1:9095` (firejail)?

gitea-mirror commented

2026-05-05 08:50:28 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jun 21, 2021):

it means, for example, the adress 127.0.0.1:9095 does not point to the same thing if I am in a firejail or not?

If you use --net=none, yes.

If yes, so I need to use --netfilter to make a bridge between 127.0.0.1:9095 (host) and 127.0.0.1:9095 (firejail)?

Nope. --netfilter is use iptables. Depending on what you want use --net=tap0/--net=br0 or just drop all --net= commands.

@rusty-snake commented on GitHub (Jun 21, 2021): > it means, for example, the adress 127.0.0.1:9095 does not point to the same thing if I am in a firejail or not? If you use `--net=none`, yes. > If yes, so I need to use --netfilter to make a bridge between 127.0.0.1:9095 (host) and 127.0.0.1:9095 (firejail)? Nope. `--netfilter` is use iptables. Depending on what you want use `--net=tap0`/`--net=br0` or just drop all `--net=` commands.

gitea-mirror commented

2026-05-05 08:50:28 -06:00

Author

Owner

@jgsch commented on GitHub (Jun 23, 2021):

just drop all --net= commands.

But if I do that, the process can communicate with the outside.

My goal is the same as OP, I want to remove internet access to a process but it still need to update a redis database so I need to keep access to locahost.

So from what I understand, there is two possibilities:

use --netfilter with an iptable to restrict all network access except for localhost (no need of --net in this case)
create a virtual namespace which block everything except localhost and use it with --net

(I'm new with all this networking stuff and it's a little bit hard to assimilate all these new things)

@jgsch commented on GitHub (Jun 23, 2021): > just drop all --net= commands. But if I do that, the process can communicate with the outside. My goal is the same as OP, I want to remove internet access to a process but it still need to update a redis database so I need to keep access to locahost. So from what I understand, there is two possibilities: - use `--netfilter` with an iptable to restrict all network access except for localhost (no need of `--net` in this case) - create a virtual namespace which block everything except localhost and use it with `--net` (I'm new with all this networking stuff and it's a little bit hard to assimilate all these new things)

gitea-mirror commented

2026-05-05 08:50:29 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jun 23, 2021):

right two possibilities:

--netfilter to block everything ecept 127.0.0.1 (--netfilter requires --net)
--net with a bridge or tap iface (or --netns)

@rusty-snake commented on GitHub (Jun 23, 2021): right two possibilities: - `--netfilter` to block everything ecept `127.0.0.1` (`--netfilter` requires `--net`) - `--net` with a bridge or tap iface (or `--netns`)

gitea-mirror commented

2026-05-05 08:50:30 -06:00

Author

Owner

@miloslavnosek commented on GitHub (Dec 1, 2024):

I'm very sorry for commenting on an old issue, however I'm facing this exact problem. I want to run a next.js server on my local machine and completely cut off from the internet, but since it's a server, I need to be able to access it from the localhost.

simply using --net=none does cut it off from the internet, but it also prevents me from being able to access the server from my browser.

I've been researching firejail, but I don't understand these suggestions. Could anyone please provide me with an example?

@miloslavnosek commented on GitHub (Dec 1, 2024): I'm very sorry for commenting on an old issue, however I'm facing this exact problem. I want to run a next.js server on my local machine and completely cut off from the internet, but since it's a server, I need to be able to access it from the localhost. simply using `--net=none` does cut it off from the internet, but it also prevents me from being able to access the server from my browser. I've been researching firejail, but I don't understand these suggestions. Could anyone please provide me with an example?

gitea-mirror commented

2026-05-05 08:50:31 -06:00

Author

Owner

@rusty-snake commented on GitHub (Dec 2, 2024):

--join-network= could do the trick in your case. Run a second browser instance in the network namespace of your server.

@rusty-snake commented on GitHub (Dec 2, 2024): `--join-network=` could do the trick in your case. Run a second browser instance in the network namespace of your server.

gitea-mirror commented

2026-05-05 08:50:31 -06:00

Author

Owner

@l8l commented on GitHub (Mar 23, 2025):

I also need this feature. Running a local database that I want to query with a program that must otherwise be cut off from the internet. Is there a way to do this already or any progress?

@l8l commented on GitHub (Mar 23, 2025): I also need this feature. Running a local database that I want to query with a program that must otherwise be cut off from the internet. Is there a way to do this already or any progress?

gitea-mirror commented

2026-05-05 08:50:31 -06:00

Author

Owner

@kmk3 commented on GitHub (Mar 23, 2025):

Re-closing as "not planned" since this is a duplicate of:

#108

@kmk3 commented on GitHub (Mar 23, 2025): Re-closing as "not planned" since this is a duplicate of: * #108

gitea-mirror commented

2026-05-05 08:50:32 -06:00

Author

Owner

@keesj commented on GitHub (Feb 17, 2026):

This appears to be such a basic question for a program called a jail (specially in these days of programs wanting to access the internet) .

@keesj commented on GitHub (Feb 17, 2026): This appears to be such a basic question for a program called a jail (specially in these days of programs wanting to access the internet) .

gitea-mirror referenced this issue

2026-05-05 10:15:24 -06:00

[PR #2161] [MERGED] Fix file.profile #4189

Rows
Columns

[GH-ISSUE #3439] How to block all internet except 127.0.0.1 localhost #2161