On Saturday 17 January 2009 07:34:59 Grant wrote: > >> That sounds good, how can I do that? > > > > iptables module "owner" handles that stuff, just "man iptables" if > > you'll have any trouble. > > > > iptables -A OUTPUT -m owner --uid-owner someuser -m tcp --dport http -j > > REJECT > > I brought this to the shorewall list for config advice, but I was told: > > a) NO PACKET FILTERING FIREWALL (which includes Shorewall) has any > notion of domains. So filterinG by domain is a non-starter. > > b) When referring to packet filters, filtering by user id (e.g., root) > can only be done for connections originating from the firewall. See "man > shoreall-rules" and read about the USER/GROUP column. > > Here was my original request: > > I'd like to restrict the websites one of the computers on my network > can access in Firefox. It only needs to access 2 different domain > names and I don't want it to be able to access any others. I can > restrict it at the router if necessary because the router is a Gentoo > system. > > I think this leaves a squid proxy setup as my only option?
Restrict by source AND destination IP This requires only that the computer in question has a static IP or a permanent lease (so you always know what it is), and you know the IP of the web sites to be accessed (dig is a very good friend). Allow these, deny everything else to destination port 80. -- alan dot mckinnon at gmail dot com
