Make sure the Pi won't waste internet bandwidth [closed]

Question

I'm using a backup internet connection on my Pi (using latest Raspbian) where bandwidth is very expensive (let's say a roamed 3G connection in a foreign country). I thus want to configure my Pi as follows:

• Don't consume any internet bandwidth without notice (or explicitly knowing about).
• Especially, don't automatically download any system or software updates.
• Don't run any background processes which will connect to the internet and consume bandwidth.
• One exception: obtaining the current system time via NTP from a time server is OK.

Which system settings do I have to change for that? Do I need to configure (or maybe even remove) some of the pre-installed software which will otherwise connect to the internet sometimes?

Answer 1

As far as I know, there is no software that allows to block the network access for background processes.

You can use AppArmor to block the Internet access for every software. You should be able to put every programs in a blacklist, and then put ntpd in the whitelist. But it will surely be painful!

For the blacklist, you can use rules similar to this (you'll have to find every paths!):

/usr/bin/* {
    # block ipv4 access
    deny network inet,
    # block ipv6 access
    deny network inet6,
    # lock raw socket
    deny network raw
}

For the whitelist:

/usr/bin/ntpd {
    # allow ipv4 access
    allow network inet
}