[GH-ISSUE #645] "netfilter" enabled by default

gitea-mirror commented

2026-05-05 05:53:15 -06:00

Owner

Originally created by @ghost on GitHub (Jul 24, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/645

Since I have my own custom rules for iptables, I decided to edit each profile in /etc/firejail and remove the "netfilter" entries for each one of them. Then I stumped upon "nolocal" which is where the rules are stored.

So instead of removing every "netfilter" line from the profiles, would simply making the "nolocal" file blank suffice to make the applications follow my global iptables rules?

Originally created by @ghost on GitHub (Jul 24, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/645 Since I have my own custom rules for iptables, I decided to edit each profile in /etc/firejail and remove the "netfilter" entries for each one of them. Then I stumped upon "nolocal" which is where the rules are stored. So instead of removing every "netfilter" line from the profiles, would simply making the "nolocal" file blank suffice to make the applications follow my global iptables rules?

gitea-mirror

2026-05-05 05:53:15 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 05:53:20 -06:00

Author

Owner

@netblue30 commented on GitHub (Jul 24, 2016):

When a new network namespace is created, it doesn't automatically inherit netfilter configuration from the main network namespace. Instead, netfilter in the new namespace has an empty configuration - all traffic allowed.

This is what I can do:

When starting the sandbox as a user, most profiles will set a netfilter configuration hardcoded in the program. I can add an entry in /etc/firejail/firejail.config and allow you to overwrite this default configuration with one you specify, something like:

default-netfilter somefile

Will this work for you?

@netblue30 commented on GitHub (Jul 24, 2016): When a new network namespace is created, it doesn't automatically inherit netfilter configuration from the main network namespace. Instead, netfilter in the new namespace has an empty configuration - all traffic allowed. This is what I can do: When starting the sandbox as a user, most profiles will set a netfilter configuration hardcoded in the program. I can add an entry in /etc/firejail/firejail.config and allow you to overwrite this default configuration with one you specify, something like: ``` default-netfilter somefile ``` Will this work for you?

gitea-mirror commented

2026-05-05 05:53:23 -06:00

Author

Owner

@ghost commented on GitHub (Jul 24, 2016):

Will this work for you?

Wouldn't that be a redundancy? Because the system is already using a system-wide configuration at /etc/iptables/iptables.rules, regardless if the program is ran via firejail or not [1]. The same would happen if the user runs ufw or similar programs.

I think a configuration like "netfilter-handling=none" in /etc/firejail/firejail.conf that would override any "netfilter" entry on the profiles would be more appropriate, making the program unable to do anything firewall related (dealing only with the sandbox part).

But to be honest, I think the perfect solution would be asking (via CLI, upon installing firejail) if the user wants firejail to handle iptables. Something like this:

Would you want firejail to handle your Firewall for sandboxed programs? If you're NOT an advanced user, you can simply say "Yes" (Y) and we'll take care of everything for you. If you already have a Firewall configuration in place, just say "No" (N) and we let you in charge of it".

[1] https://raw.githubusercontent.com/amarildojr/Firewall/master/rules

@ghost commented on GitHub (Jul 24, 2016): > Will this work for you? Wouldn't that be a redundancy? Because the system is already using a system-wide configuration at /etc/iptables/iptables.rules, regardless if the program is ran via firejail or not [1]. The same would happen if the user runs ufw or similar programs. I think a configuration like "netfilter-handling=none" in /etc/firejail/firejail.conf that would override any "netfilter" entry on the profiles would be more appropriate, making the program unable to do anything firewall related (dealing only with the sandbox part). But to be honest, I think the perfect solution would be asking (via CLI, upon installing firejail) if the user wants firejail to handle iptables. Something like this: > Would you want firejail to handle your Firewall for sandboxed programs? If you're NOT an advanced user, you can simply say "Yes" (Y) and we'll take care of everything for you. If you already have a Firewall configuration in place, just say "No" (N) and we let you in charge of it". [1] https://raw.githubusercontent.com/amarildojr/Firewall/master/rules

gitea-mirror commented

2026-05-05 05:53:25 -06:00

Author

Owner

@netblue30 commented on GitHub (Jul 24, 2016):

No, the kernel doesn't care about system wide configuration rules. Every time it creates a network namespace, the filter is empty. So, when you create the namespace, you need to tell the kernel everytihing: IP addresses, default gateway and netfilter configuration.

@netblue30 commented on GitHub (Jul 24, 2016): No, the kernel doesn't care about system wide configuration rules. Every time it creates a network namespace, the filter is empty. So, when you create the namespace, you need to tell the kernel everytihing: IP addresses, default gateway and netfilter configuration.

gitea-mirror commented

2026-05-05 05:53:28 -06:00

Author

Owner

@ghost commented on GitHub (Jul 24, 2016):

So it would be OK to use "default-netfilter" and point it to "/etc/iptables.iptables.rules"?
Or is it simpler to edit the "nolocal.net" file and set it as an exact copy of my iptables.rules?

Whichever is easier for both of us, please let me know :)

@ghost commented on GitHub (Jul 24, 2016): So it would be OK to use "default-netfilter" and point it to "/etc/iptables.iptables.rules"? Or is it simpler to edit the "nolocal.net" file and set it as an exact copy of my iptables.rules? Whichever is easier for both of us, please let me know :)

gitea-mirror commented

2026-05-05 05:53:30 -06:00

Author

Owner

@netblue30 commented on GitHub (Jul 24, 2016):

Yes, you'll be able to use "default-netfilter" and point it to "/etc/iptables/iptables.rules", and it will be global over the system. As soon as firejail starts, it will load it. I'll have the fix in the next few days, it is very easy, and I think it could be useful to some other people.

@netblue30 commented on GitHub (Jul 24, 2016): Yes, you'll be able to use "default-netfilter" and point it to "/etc/iptables/iptables.rules", and it will be global over the system. As soon as firejail starts, it will load it. I'll have the fix in the next few days, it is very easy, and I think it could be useful to some other people.

gitea-mirror commented

2026-05-05 05:53:35 -06:00

Author

Owner

@ghost commented on GitHub (Jul 24, 2016):

Thank you! :D

@ghost commented on GitHub (Jul 24, 2016): Thank you! :D

gitea-mirror commented

2026-05-05 05:53:37 -06:00

Author

Owner

@ghost commented on GitHub (Jul 24, 2016):

BTW, what will happen to "nolocal.net"? It can simply stay there?

@ghost commented on GitHub (Jul 24, 2016): BTW, what will happen to "nolocal.net"? It can simply stay there?

gitea-mirror commented

2026-05-05 05:53:38 -06:00

Author

Owner

@netblue30 commented on GitHub (Jul 25, 2016):

People still can use it: "firejail --net=eth0 --netfilter=/etc/firejail/nolocal.net firefox" and you get a browser without access on the local network. If somebody breaks into the browser, there will be no connectivity on the local network.

@netblue30 commented on GitHub (Jul 25, 2016): People still can use it: "firejail --net=eth0 --netfilter=/etc/firejail/nolocal.net firefox" and you get a browser without access on the local network. If somebody breaks into the browser, there will be no connectivity on the local network.

gitea-mirror commented

2026-05-05 05:53:39 -06:00

Author

Owner

@netblue30 commented on GitHub (Jul 28, 2016):

All set in git, you can try it.

@netblue30 commented on GitHub (Jul 28, 2016): All set in git, you can try it.

gitea-mirror commented

2026-05-05 05:53:41 -06:00

Author

Owner

@ghost commented on GitHub (Jul 29, 2016):

Thanks, but it didn't work for me.

This is the "off.rules" I'll be referencing on firejail.conf:

Generated by iptables-save v1.6.0 on Thu Jul 28 23:56:39 2016

*filter
:INPUT DROP [3:218]
:FORWARD DROP [0:0]
:OUTPUT DROP [112:6832]
COMMIT

Completed on Thu Jul 28 23:56:39 2016

Firejail.conf:

netfilter-default /etc/iptables/off.rules

It seems that firejail can't override what is already being managed by iptables.service, which loads my "out.conf" (see my Firewall repo).

@ghost commented on GitHub (Jul 29, 2016): Thanks, but it didn't work for me. This is the "off.rules" I'll be referencing on firejail.conf: > # Generated by iptables-save v1.6.0 on Thu Jul 28 23:56:39 2016 > > *filter > :INPUT DROP [3:218] > :FORWARD DROP [0:0] > :OUTPUT DROP [112:6832] > COMMIT > > # Completed on Thu Jul 28 23:56:39 2016 Firejail.conf: > netfilter-default /etc/iptables/off.rules It seems that firejail can't override what is already being managed by iptables.service, which loads my "out.conf" (see my Firewall repo).

gitea-mirror commented

2026-05-05 05:53:42 -06:00

Author

Owner

@netblue30 commented on GitHub (Jul 29, 2016):

How do you start the sandbox? Are you using --net command?

@netblue30 commented on GitHub (Jul 29, 2016): How do you start the sandbox? Are you using --net command?

gitea-mirror commented

2026-05-05 05:53:45 -06:00

Author

Owner

@ghost commented on GitHub (Aug 10, 2016):

Sorry for the late reply.

I had forgotten about that switch. It works :)
Thank you a lot for listening the community and implementing features so quickly. Not a lot of developers do that.

Cheers!

@ghost commented on GitHub (Aug 10, 2016): Sorry for the late reply. I had forgotten about that switch. It works :) Thank you a lot for listening the community and implementing features so quickly. Not a lot of developers do that. Cheers!

gitea-mirror commented

2026-05-05 05:53:46 -06:00

Author

Owner

@netblue30 commented on GitHub (Aug 10, 2016):

No problem, let me know if you need anything else, at this point new features are easy to add.

@netblue30 commented on GitHub (Aug 10, 2016): No problem, let me know if you need anything else, at this point new features are easy to add.

gitea-mirror referenced this issue

2026-05-05 10:04:57 -06:00

[PR #450] [MERGED] Blacklist vera crypt #3628

Rows
Columns

[GH-ISSUE #645] "netfilter" enabled by default #450

Generated by iptables-save v1.6.0 on Thu Jul 28 23:56:39 2016

Completed on Thu Jul 28 23:56:39 2016