dtgreene: Don't forget to run your games with something like "firejail --net=none" if you're sp concerned about this.
Never heard of firejail. I suppose I should look into it. It probably does the same thing I do, but without requiring me to maintain it. I set up a network namespace containing only looopback at system startup, and use a suid stripped down iproute2 that just switches to that namespace and executes its arguments. My game wrapper script and my wine wrapper script both use this, and I only allow winetricks to bypass it (and, because I am not as paranoid as I should be, I also allow Zachtronics games to occasionally connect, so I can see how my solutions fare against the rest of the world). Of course apps can still bypass it by executing the web browser while I already have one up (not a significant enough hole for me to patch it, yet).
edit: Also, I cheat too much to want to play network multi-player (given that even loading a prior save is technically cheating, unless you're doing it to bypass game bugs). And the sort of games I might want to play multi-player usually have PBEM modes.