>> >> That sounds good, how can I do that? >> > >> > iptables module "owner" handles that stuff, just "man iptables" if >> > you'll have any trouble. >> > >> > iptables -A OUTPUT -m owner --uid-owner someuser -m tcp --dport http -j >> > REJECT >> >> I brought this to the shorewall list for config advice, but I was told: >> >> a) NO PACKET FILTERING FIREWALL (which includes Shorewall) has any >> notion of domains. So filterinG by domain is a non-starter. >> >> b) When referring to packet filters, filtering by user id (e.g., root) >> can only be done for connections originating from the firewall. See "man >> shoreall-rules" and read about the USER/GROUP column. >> >> Here was my original request: >> >> I'd like to restrict the websites one of the computers on my network >> can access in Firefox. It only needs to access 2 different domain >> names and I don't want it to be able to access any others. I can >> restrict it at the router if necessary because the router is a Gentoo >> system. >> >> I think this leaves a squid proxy setup as my only option? > > Restrict by source AND destination IP > > This requires only that the computer in question has a static IP or a > permanent lease (so you always know what it is), and you know the IP of the > web sites to be accessed (dig is a very good friend). Allow these, deny > everything else to destination port 80.
That sounds good, but I won't be able to fetch all updates that portage might want, right? - Grant
