Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On my local network I have to setup Linux Ubuntu boxes, so users will be able to access only to few (2-3) domains. Also, all of those Linux Ubuntu boxes are behind Proxy.

Tried to configure this using Firestarter, but I did not make it after several hours of attempts.

Most of the time, I was able to access to all of Internet, or wasn't at all - in Firefox I was getting the message:

The proxy server is refusing connections.

IP address of Proxy server is

What I tried with Firestarter is to define Outbound traffic policy as Restrictive by default => whitelist traffic => Allow connections to host:, and several IP addresses I want to give access. But no luck, all of the websites where blocked in this case.

Also, tried to Allow service DNS (port 53), and Http-alt (port 8080) to several IP addresses I want to give access.

But I did not make it.

Also, I removed UFW (Uncomplicated Firewall) with all of it's definition, and on Iptables I have no rule defined.

Can you help me please how to configure firewall in this case?

share|improve this question
Firewall and proxy are 2 different things. It looks like the proxy itself is refusing connections based on that output you pasted above. You can try to check proxy rules first, if it's working. Then configure your firewall afterwards. – Marky Mar 5 '13 at 15:43
yes, i know that they are separate things. everything works well if firewall (firestarter in this case) is stopped. i need help how to configure firestarter and with that configuration to be able to access only to several ip addresses – user52869 Mar 5 '13 at 16:02
I just did a quick test. I installed Firestarter and added one rule to allow only incoming connections from Proxy IP and outgoing connections to the same IP (restrictive like you said). Nothing else, not even configuring which ports are allowed. It works. All other apps that need to connect directly are blocked. Only my browser, w/c I've configured to use proxy, can connect. – Marky Mar 5 '13 at 17:07
My iptables is a bit rusty. Been years since I've touched this but do check with iptables -nL. Basically, IIRC it should look like this - since you are whitelisting IPs, the default rules are to DROP all INPUT, OUTPUT and FORWARD. Then allow all INPUT, OUTPUT if the source/destination interface is local. Now create a rule (or rules) to specifically allow connections to X IP @ Y PORT @ what STATE. – Marky Mar 5 '13 at 17:24
@Marky - funny thing about working with firestarter is that in some cases i was able to create proper configuration, i restarted network and disabled-enabled firestarter, and everything was working well as it shoud for few minutes. after that, or everything stopped (no proxy to find), or i had access to all internet sites. can that be in your case also? – user52869 Mar 5 '13 at 17:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.