# How do I set up user level restrictions on a gateway?

I am aware that Ubuntu Server can be used as a gateway to allow Internet connection to a LAN.

Then we use IP tables or other firewall settings to restrict (for example), certain websites from being accessed.

My question: Can this restriction be done on individual users, and if so could some please share a link or resource that I may use for this purpose?

-
how many individual users will you be having?, Are the users using Linux or Windows? –  tomodachi Aug 15 '12 at 10:47
@tomodachi On the LAN around 35 users –  itsols Aug 15 '12 at 16:30

You can use something like iptables -A OUTPUT -m owner --uid-owner 1001 to match on a local user. But this only works for users on the firewall machine.

Over the network, your firewall needs to be able to identify which user is which. Normal Internet traffic has source and destination addresses only and are not tagged with usernames, which means that your firewall cannot differentiate between different users and so cannot block different users differently.

So blocking by machine is easy, but blocking by user is non-trivial without some extra mechanism in place to differentiate users.

If you want to block website traffic, you can do this using a web proxy server such as squid. You will need to configure your firewall to block web traffic except traffic going via squid.

There are various ways to configure users so that they go through the proxy, including "web proxy auto detect" (wpad), "proxy.pac", "transparent proxying" and manually.

HTTP supports an extra proxy authentication step, and if you enable this then users will be prompted for a username and password when they attempt web access. Then squid will know who is who.

Finally, there are various solutions that plug in to squid that make decisions on what is and isn't blocked; although if you just want some specific URLs blocked then you can do this in squid directly.

-
Please clarify these: ONE: Must all users have IPv4? TWO: Are you saying that with SQUID we CAN filter traffic at least machine-wise? THREE: Is it necessary to have a proxy just to have machine-wise restrictions? FOUR: About the extra HTTP Auth... Does this mean that for every user we can give restricted access to certain sites? THANK YOU FOR YOUR ANSWER SO FAR! –  itsols Aug 16 '12 at 16:50