Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
To stop one AI-powered Linux application from reaching the internet while leaving other programs online, run it under a dedicated Unix user, systemd service, or cgroup and block that identity in an nftables inet output chain. An inet table covers both IPv4 and IPv6, so the application cannot simply switch address families. For a systemd-managed service, you can also apply RestrictNetworkInterfaces= or let systemd maintain a cgroup set referenced by nftables.
The reliable workflow is: choose a stable identity, create a persistent nftables rule, keep only the local traffic the application genuinely needs, then verify DNS, IPv4, IPv6 and alternate protocols from the application’s own account. Blocking only a process name or TCP port 443 is easy for helper processes, QUIC, proxies or IPv6 to evade.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
Why is identity-based blocking better than matching an AI app’s name?
A process-name rule depends on how the program happens to identify itself. Desktop applications may spawn helpers, rename executables, launch a browser component or connect through another process. A changing PID is even less suitable for a permanent policy.
Unix users, groups, systemd services and cgroups survive ordinary restarts and give nftables an identity it can match on every outbound packet. The enforcement scope is explicit: you can isolate one service, every process belonging to one account, or a whole control group without cutting networking for the rest of the host.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
| Method | Scope | IPv4 and IPv6 | Survives restart | Helper-process resistance | Desktop-launcher fit | Operational complexity |
|---|---|---|---|---|---|---|
| Process name or PID | One matching process | Only if separate rules cover both families | No, unless a watcher recreates it | Low | Usually poor | Low initially, fragile later |
| Dedicated Unix user or group | All sockets created by that identity | Yes, with an inet output chain |
Yes | Good when helpers inherit the identity | Requires a wrapper or launcher | Moderate |
| Dedicated systemd service and cgroup | The service control group | Yes, with an inet output chain |
Yes | Strong for children started by the service | Good for applications that can run as services | Moderate to high |
RestrictNetworkInterfaces= |
Every process in a service cgroup | Applies at the interface layer to both families | Yes | Strong within that cgroup | Service-oriented | Low after service conversion |
| Host-wide firewall block | Every process on the machine | Yes when written in inet |
Yes if persisted | Strong | Not appropriate when other applications need access | Low, but excessive scope |
For most desktop installations, a dedicated account plus nftables is the clearest starting point. A systemd service is preferable when you already have a repeatable start command or need cgroup-level control over all children.
What must be installed and where should nftables rules live?
Install the distribution’s nftables package and keep the declarative configuration in /etc/nftables.conf. Ubuntu’s instructions cover package installation, enabling nftables.service, inspecting rules and loading this file; Debian documents the same default location and dual-stack inet tables.
sudo apt update
sudo apt install nftables
sudo systemctl enable --now nftables
sudo nft list rulesetOn another distribution, use its package manager but retain the same principles. Commands entered directly with nft are ephemeral: they disappear at reboot unless the nftables service or an equivalent configuration-management system loads them. Put production rules in /etc/nftables.conf, review them, and then load them with:
sudo nft -f /etc/nftables.conf
sudo nft list rulesetUbuntu notes that nftables applies a requested batch atomically: packet processing sees either the old rules or the complete new rules, not a partially edited ruleset. That makes editing a file and loading it safer than issuing a long series of unrelated changes.
How do I block an application by dedicated Unix user?
Create an account used only for the AI application, ensure the application and its helpers run under that account, then match its UID in an inet output chain. This blocks locally generated packets from that identity on both IPv4 and IPv6 while leaving other users untouched.
1. Create the account and identify its UID
sudo useradd --system --create-home --shell /usr/sbin/nologin ai-offline
id -u ai-offlineUse a normal login account instead if the application needs a graphical desktop session. The important property is exclusive ownership: do not run unrelated networked programs as the same user.
2. Run the application as that identity
For a command-line or wrapper launch, use:
sudo -u ai-offline -- /opt/ai-app/appA desktop launcher can call a wrapper script that uses sudo -u, runuser, or a user-level service. Confirm the process owner with ps -o user,pid,cmd -C app; if a helper is owned by your regular account, the UID rule will not cover it.
3. Add a UID set and an output-chain drop
Replace 1001 with the value printed by id -u. The loopback exception preserves local IPC and local services; remove or narrow it only after checking what the application needs.
table inet ai_block {
set blocked_uids {
type uid
elements = { 1001 }
}
chain output {
type filter hook output priority filter; policy accept;
oifname "lo" accept
meta skuid @blocked_uids counter drop
}
}Save the table in /etc/nftables.conf (or merge it with your existing tables), load it, and inspect the resulting chain:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
sudo nft -f /etc/nftables.conf
sudo nft list table inet ai_block
sudo nft list chain inet ai_block outputmeta skuid matches the user ID associated with the locally created socket. If you deliberately run the application under a dedicated primary group, use a group set and meta skgid instead. Group matching is easy to misapply when supplementary groups or inherited launchers are involved, so verify the effective identity of every process.
How do I put the AI application in a systemd service?
A system service gives the application a stable cgroup and a predictable owner. It also makes boot-time startup, logging and later hardening reproducible.
Create a service unit
Create /etc/systemd/system/ai-offline.service with paths and arguments appropriate to your installation:
[Unit]
Description=Offline AI application
After=graphical-session.target
[Service]
Type=simple
User=ai-offline
Group=ai-offline
WorkingDirectory=/opt/ai-app
ExecStart=/opt/ai-app/app --your-options
Restart=on-failure
[Install]
WantedBy=multi-user.targetThen load and start it:
sudo systemctl daemon-reload
sudo systemctl enable --now ai-offline.service
systemctl status ai-offline.service
ps -eo user,pid,cmd | grep '[a]pp'If the program needs a graphical display, supply the appropriate DISPLAY, Wayland and D-Bus environment through the service or use a per-user launcher that still assigns a dedicated account. A per-user systemd manager is not interchangeable with the system service for every security feature described below.
How can systemd maintain an nftables cgroup set?
systemd’s NFTSet= option can publish a service’s cgroup or user membership into a pre-existing nftables set. You write the firewall policy; systemd updates set membership as the service starts and stops. The documented option and examples are in the systemd.resource-control manual.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Define the set and rule first
The set must exist before systemd starts managing it. A typical cgroup-based layout is:
table inet ai_block {
set blocked_cgroups {
type cgroupv2
}
chain output {
type filter hook output priority filter; policy accept;
oifname "lo" accept
meta cgroupv2 @blocked_cgroups counter drop
}
}Load this table and confirm that your nftables version accepts the cgroup expression:
sudo nft -f /etc/nftables.conf
sudo nft list set inet ai_block blocked_cgroupsAttach the set to the service
Add the documented set reference to the unit’s [Service] section:
NFTSet=inet:ai_block:blocked_cgroupsAfter editing, run sudo systemctl daemon-reload and restart the service. Inspect the set while it is running; systemd should add the service’s cgroup member. The exact nftables expression and set type must match your kernel, nftables and systemd versions, so treat sudo nft list ruleset as the authority after loading.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
NFTSet= requires pre-created tables and sets, and systemd manages membership rather than the drop decision. The systemd 255 manual states that this feature is for system services and is not supported in per-user service-manager instances. If your application is launched only from a desktop user session, the dedicated-UID method is usually simpler.
Can systemd block an interface without nftables?
Yes. RestrictNetworkInterfaces= limits interfaces for every process in a service control group. A plain interface name is an allow-list; prefixing a name with ~ creates a deny-list. For example:
[Service]
RestrictNetworkInterfaces=eth0allows only eth0, while:
[Service]
RestrictNetworkInterfaces=~eth0denies eth0 but may still permit another interface such as Wi-Fi, a VPN, or a tunnel. An allow-list is therefore safer when the goal is “no network”: name every interface that the service may use, or combine the restriction with an nftables identity rule.
The restriction applies to the whole control group and cannot be bypassed by prefixing an executable path with +; the systemd manual explicitly describes that behavior. Interface restrictions and firewall rules are different controls: the former constrains where a cgroup may send traffic, while the latter can inspect identity, address, protocol and port.
Free tools Windows power users keep installed
One-click scans. No signup required.
How should the nftables output rule handle IPv6, loopback and existing services?
Use an inet table and an output chain. That family covers IPv4 and IPv6 in one policy, preventing a blocked application from falling back to IPv6. A rule that blocks only TCP port 443 is incomplete because applications can use DNS, UDP-based QUIC, alternate ports, proxies or an already established connection.
Keep the loopback exception only if local communication is required. Some applications use a local model server, desktop portal or resolver over loopback. If you need to block those channels too, remove the blanket oifname "lo" accept and add narrowly scoped allows for the exact address and port, testing each dependency afterward.
Do not add a broad ct state established,related accept rule ahead of the identity drop unless you intentionally want existing flows to continue. Such an exception can let an application keep sending on connections opened before the rule was applied. For a strict cutoff, the identity drop should be reached for all non-loopback output from the target.
Why might DNS still work after the application is blocked?
DNS may be handled by a separate resolver such as a host service. The AI process can ask a resolver on loopback or through a local IPC interface, while the resolver itself sends DNS packets under a different identity. In that case, name lookups can succeed even though the application’s direct internet connections are dropped.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsDecide which outcome you need:
- Block application payload traffic only: leave the local resolver path available and enforce the UID or cgroup drop on non-loopback output.
- Prevent the application from resolving names: remove or narrow loopback access, or create a separate resolver policy that distinguishes requests from the target account. This can affect other programs if they share the resolver.
- Prevent all host DNS access: apply a separate resolver or firewall policy deliberately; do not assume the application’s UID rule controls a system-wide resolver process.
Check both the application’s own behavior and the resolver’s logs when diagnosing this distinction.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
How do I persist, inspect and safely change the rule?
Keep /etc/nftables.conf under administrative change control and make a backup before edits:
sudo cp /etc/nftables.conf /etc/nftables.conf.backup
sudo nft list ruleset > /tmp/nftables-before-change.txtValidate a revised file by loading it with sudo nft -f /etc/nftables.conf, then inspect the table and counters. If the load fails, nftables leaves the previous ruleset in place; correct the syntax before restarting the service. After a reboot, confirm that nftables.service is enabled and that the target set still contains the expected UID or cgroup.
Rule counters show whether packets are reaching the drop. They are more useful than assuming that a launcher behaved as intended:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →sudo nft list chain inet ai_block output
sudo journalctl -u nftables --no-pager
systemctl status ai-offline.serviceHow do I verify that only the intended application lost internet access?
Test from the same account or service context, not from your regular shell. Start the application, perform an operation that would normally contact a server, and watch the nftables counter increase.
- Confirm ownership:
ps -eo user,pid,cmdshould show the dedicated user or service child processes. - Test name resolution:
sudo -u ai-offline getent hosts example.com. Interpret a successful result in light of any shared local resolver. - Test an IPv4 destination:
sudo -u ai-offline curl --connect-timeout 5 -4 https://example.com. A timeout or connection failure is expected when the drop is active. - Test IPv6 separately where the host has IPv6:
sudo -u ai-offline curl --connect-timeout 5 -6 https://example.com. - Exercise the actual application, including any update checker, plugin helper, browser window or model-download feature. Helpers must inherit the blocked identity.
- Run the same IPv4 and IPv6 tests as your ordinary user to confirm unrelated applications retain their intended connectivity.
This is a verification procedure, not a claim that every AI application behaves identically. Proxies, containers, setuid helpers and user namespaces can change which identity creates a socket; inspect those components rather than weakening the rule blindly.
What are the common bypasses and fixes?
The application changes its process name
Replace name matching with a dedicated UID, group, service or cgroup. A stable identity follows the service even when executable names and PIDs change.
A helper runs under another account
Inspect the full process tree and service unit. Set User= and, where appropriate, Group= in the unit, or create a separate rule for a helper that you deliberately trust. Do not assume a child inherited the expected identity.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
IPv6 still works
Check that the rule is in an inet table and that the packet is locally generated by the matched UID or cgroup. A separate ip-family-only rule does not cover IPv6.
A VPN or second interface provides an alternate path
An interface deny-list can leave another interface available. Prefer an identity drop in the output chain for “no external network,” or design an explicit interface allow-list with RestrictNetworkInterfaces=.
Traffic goes through a proxy
Blocking direct destinations does not block a proxy that the application is allowed to reach. Drop the target identity’s connection to the proxy as well, or run the proxy under a policy that enforces the same destination restrictions.
The application is containerized
Host output rules may see the container runtime’s identity rather than the process’s account. Apply equivalent policy in the container’s network namespace or match the runtime’s cgroup and verify from inside the container.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhat does this protection not do?
Network egress control does not disable offline model execution, prevent the application from reading local files, or stop communication with an explicitly allowed local service or proxy. It also does not prove that an application has no network path if it can ask another privileged component to make connections on its behalf.
For high-assurance isolation, combine the nftables policy with least-privilege filesystem permissions, a dedicated service account, systemd sandboxing and a review of privileged helpers. Treat those as separate controls: blocking internet access is necessary for an offline policy, but it is not a complete application sandbox.
Frequently Asked Questions
Can I temporarily re-enable the app’s network access without deleting the policy?
Yes. Stop the service or remove its UID from the nftables set, then restore the set member and reload the configuration when finished. Record the change and inspect the output-chain counter so a temporary exception does not become an unnoticed permanent one.
Does a firewall rule stop an AI app from contacting a local model server?
Not if the rule explicitly accepts loopback traffic. Local model servers, desktop portals and shared resolvers often use loopback, so decide separately whether those dependencies are allowed and replace a blanket loopback exception with narrow address-and-port rules when necessary.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What happens if the application launches through a browser?
The browser may create the internet socket under the browser’s account, outside the AI process’s UID rule. Use a dedicated browser profile and account, isolate the browser in the same systemd cgroup where practical, or enforce the restriction at the browser’s own identity.
Can I use this approach on a machine that has no IPv6 connectivity?
Yes. The inet family still provides one policy for both protocol families, and the IPv6 test simply fails because the host has no route. Keeping the rule dual-stack avoids a future bypass if IPv6 is later enabled.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
