4 ms·
> ability to filter by incoming port and process ID combined Considering Process ID almost always changes, is that a significant limitation? I can think of one
by noisy_boy 3y ago
> ability to filter by incoming port and process ID combined
Considering Process ID almost always changes, is that a significant limitation? I can think of one use case when it can be useful is when you want to apply the rule temporarily until the process is restarted.
- egberts1 3y agoWhen working with default deny firewall rulesets, inbound port by PID is an essential rule mechanism.
- noisy_boy 3y agoI still don't get it - how do you define rules by PID and make it work after the next reboot? Won't the PID change for the process in question? I assume by PID we are talking about the same Process ID that we can see in "ps"
- egberts1 3y agoIt may not be obvious but one (lesser) application is to block all ports to PID 1 ... for logging purpose. Most of this kind of firewall rule get created after such executable starts ... by a dedicated firewall daemon monitoring the operating system's PID state (creation/deletion/child).