1 |
>> That sounds good, how can I do that? |
2 |
> |
3 |
> iptables module "owner" handles that stuff, just "man iptables" if |
4 |
> you'll have any trouble. |
5 |
> |
6 |
> iptables -A OUTPUT -m owner --uid-owner someuser -m tcp --dport http -j REJECT |
7 |
|
8 |
I brought this to the shorewall list for config advice, but I was told: |
9 |
|
10 |
a) NO PACKET FILTERING FIREWALL (which includes Shorewall) has any |
11 |
notion of domains. So filterinG by domain is a non-starter. |
12 |
|
13 |
b) When referring to packet filters, filtering by user id (e.g., root) |
14 |
can only be done for connections originating from the firewall. See "man |
15 |
shoreall-rules" and read about the USER/GROUP column. |
16 |
|
17 |
Here was my original request: |
18 |
|
19 |
I'd like to restrict the websites one of the computers on my network |
20 |
can access in Firefox. It only needs to access 2 different domain |
21 |
names and I don't want it to be able to access any others. I can |
22 |
restrict it at the router if necessary because the router is a Gentoo |
23 |
system. |
24 |
|
25 |
I think this leaves a squid proxy setup as my only option? |
26 |
|
27 |
- Grant |