1 |
>>> >> That sounds good, how can I do that? |
2 |
>>> > |
3 |
>>> > iptables module "owner" handles that stuff, just "man iptables" if |
4 |
>>> > you'll have any trouble. |
5 |
>>> > |
6 |
>>> > iptables -A OUTPUT -m owner --uid-owner someuser -m tcp --dport http -j |
7 |
>>> > REJECT |
8 |
>>> |
9 |
>>> I brought this to the shorewall list for config advice, but I was told: |
10 |
>>> |
11 |
>>> a) NO PACKET FILTERING FIREWALL (which includes Shorewall) has any |
12 |
>>> notion of domains. So filterinG by domain is a non-starter. |
13 |
>>> |
14 |
>>> b) When referring to packet filters, filtering by user id (e.g., root) |
15 |
>>> can only be done for connections originating from the firewall. See "man |
16 |
>>> shoreall-rules" and read about the USER/GROUP column. |
17 |
>>> |
18 |
>>> Here was my original request: |
19 |
>>> |
20 |
>>> I'd like to restrict the websites one of the computers on my network |
21 |
>>> can access in Firefox. It only needs to access 2 different domain |
22 |
>>> names and I don't want it to be able to access any others. I can |
23 |
>>> restrict it at the router if necessary because the router is a Gentoo |
24 |
>>> system. |
25 |
>>> |
26 |
>>> I think this leaves a squid proxy setup as my only option? |
27 |
>> |
28 |
>> Restrict by source AND destination IP |
29 |
>> |
30 |
>> This requires only that the computer in question has a static IP or a |
31 |
>> permanent lease (so you always know what it is), and you know the IP of the |
32 |
>> web sites to be accessed (dig is a very good friend). Allow these, deny |
33 |
>> everything else to destination port 80. |
34 |
> |
35 |
> That sounds good, but I won't be able to fetch all updates that |
36 |
> portage might want, right? |
37 |
> |
38 |
> - Grant |
39 |
|
40 |
But I could install a wide-open firewall on the system-to-restrict and |
41 |
use that firewall to restrict website access instead of the router's |
42 |
firewall. That way I could consider the user (root, non-root) when |
43 |
deciding whether or not to allow the 80/443 outbound connection since: |
44 |
|
45 |
"When referring to packet filters, filtering by user id (e.g., root) |
46 |
can only be done for connections originating from the firewall." |
47 |
|
48 |
That should restrict website access and allow portage to do its thing. |
49 |
|
50 |
- Grant |