How do I set up user level restrictions on a gateway?

Question

I am aware that Ubuntu Server can be used as a gateway to allow Internet connection to a LAN.

Then we use IP tables or other firewall settings to restrict (for example), certain websites from being accessed.

My question: Can this restriction be done on individual users, and if so could some please share a link or resource that I may use for this purpose?

Answer 1

You can use something like iptables -A OUTPUT -m owner --uid-owner 1001 to match on a local user. But this only works for users on the firewall machine.

Over the network, your firewall needs to be able to identify which user is which. Normal Internet traffic has source and destination addresses only and are not tagged with usernames, which means that your firewall cannot differentiate between different users and so cannot block different users differently.

So blocking by machine is easy, but blocking by user is non-trivial without some extra mechanism in place to differentiate users.

If you want to block website traffic, you can do this using a web proxy server such as squid. You will need to configure your firewall to block web traffic except traffic going via squid.

There are various ways to configure users so that they go through the proxy, including "web proxy auto detect" (wpad), "proxy.pac", "transparent proxying" and manually.

HTTP supports an extra proxy authentication step, and if you enable this then users will be prompted for a username and password when they attempt web access. Then squid will know who is who.

Finally, there are various solutions that plug in to squid that make decisions on what is and isn't blocked; although if you just want some specific URLs blocked then you can do this in squid directly.