Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I prevent Desktop Users from accessing any online website? I tried * in /etc/hosts but it didn't do the trick.

Please note that I need to keep http://localhost fully functional.


share|improve this question
Can you give us some more informations??What type of connection it is???IS that standalone PC?Or connected to LAN network?? – karthick87 Dec 18 '10 at 6:52

The quickest (albeit very circumventable method) in my mind would be to break the DNS lookup. What you're doing in /etc/hosts is close but it doesn't accept wildcards. This is a shame because, like you, this sort of setup would really help me from time to time.

Anyway, remove the wildcard entry from /etc/hosts and then edit your network connection. If it's wired, you can edit /etc/networking/interfaces, if it's not, you can just go in through network manager.

Either way, set the connection type to "Automatic DHCP (Address only)" or "Manual" and then set the DNS server as I assume you're not running a DNS proxy server on the machine (otherwise this won't work).

In network manager, this will look something like this:

Click apply. It'll hopefully reconnect and then websites not listed explicitly in /etc/hosts should not resolve.

The workaround that any user can use is they can just type in the IP of the website they want to connect to. You'd need to break more gateway settings to fully neuter the machine.

Note this will probably cut you off from updates. If you want to still get updates, add manual DNS strings to /etc/hosts for each server you connect to (look at what sudo apt-get update does.

share|improve this answer

Another, more robust method, is to install a content screener like DansGuardian. This, with a couple of iptables config lines will redirect all traffic through it and only allow content that it likes. It uses a proxy (either Squid or TinyProxy - the second being my preferred choice) and its config can be set to only allow certain domains.

IPTables is the thing that makes this rock solid. Only somebody with root or full sudo access would be able to circumvent this. It's a bit more work than just cutting off DNS lookups though.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.