--pid-owner was removed from Linux some time in the 2.4 days IIRC. That's a really outdated version of the man page. The current one is: https://ipset.netfilte

--pid-owner was removed from Linux some time in the 2.4 days IIRC. That's a really outdated version of the man page. The current one is: https://ipset.netfilter.org/iptables-extensions.man.html https://ipset.netfilter.org/iptables-extensions.man.html Probably the closest thing these days is to use the cgroup match extension, together with something that makes sure separate apps are moved to their own cgroup. But that cgroup would be under a separate parent cgroup for each user so it's not ideal. I expect NFQUEUE or some EBPF magic is a better way to do things - you don't want to be constantly adding/removing per-process iptables rules.