Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

basically I have two machines X and Y.

I want to block "http:// <IP-of-Y-Here> /AFolder/" from machine X on HTTP port 80 using ufw.

Trivially, this can be completed (awfully) using ufw through:

sudo ufw deny out 80

But is it possible to do something along the lines of:

ufw deny from (X IP ADDRESS) port 80 to (Y IP ADDRESS)/AFolder

That will satisfy my requirements?

share|improve this question
up vote 4 down vote accepted

No, you cannot use ufw to block access to some specific pages on a web server but not others.

ufw is a frontend for iptables which controls the netfilter firewall, which is built into the Linux kernel. This is an ordinary firewall--you can use it to filter packets based on their headers.

An IP address and port are included in a packet's headers, but what web document is being retrieved is not. Instead, this information is transmitted in the bodies of packets, after a connection is already established.

As you're probably aware, it is possible to block access to certain websites (though it's usually pretty easy for someone to circumvent the block), and there are utilities that provide the granularity to block specific pages while allowing access to other pages on the same server. But to address what you've asked: ufw will not do this.

share|improve this answer
Spot on, thank you :) – Ed George Mar 19 '13 at 16:35

You can block access to a port on a server with ufw. man ufw has a whole raft of examples but assuming it's enabled, it should be like this:

sudo ufw deny out to <<ip address>> port 80

I've just tested this against my own server and it works. Remember that port 443 is used for SSL so that might want blocking too.

Remember, this blocks the whole of port 80 on this server.

If you want to start filtering based on subfolders (allowing some paths but not others) you're going to need something that proxies the requests. A firewall doesn't look at the content, it looks at the connections. To a firewall, a request for /subfolder is the same as a request to /a-different-subfolder.

So what you're looking for is a transparent proxy that you can twist into nixing some of your traffic. Parental-control software is probably your best bet for a quick setup. Something like dansguardian certainly used to be popular and I would say it warrants exploration. More information is available on the wiki:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.