Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

This question popped a couple of days ago and it is: How to block, deny or redirect an IP address or domain name to another IP or web domain without the use of a router or configuring a browser. Basically using only Ubuntu to do this.

For example, a user uses a computer, he/she does not have access to facebook or twitter (could be a denied access forever or just between 2pm to 8pm). If the user tries to enter facebook or twitter it will be redirected to another place or just plained canceled.

The program would be preferable in GUI but if there isn't terminal will do.

I have checked out for example ufw and gufw but it only works for programs and ports. The case about domain names is not there. Which would make it easier to select or deselect a domain.

share|improve this question
    
I think what you want is a transparent proxy. squid is a classic. See debian-administration.org/articles/71 If that is what you want , I can write it up. The main components are a gateway, iptables, and configuration of squid. –  bodhi.zazen Dec 14 '11 at 0:17
    
Thanks bodhi. Just in case take into account that this should be done from the same PC and not with a server in the middle or something. –  Luis Alvarado Dec 14 '11 at 0:27
    
OK, you would simply add your proxy, squid, dansguardian, on the local box, and re-direct with iptables. would you please take a look at this, blog.bodhizazen.net/linux/how-to-transparent-proxy , I can transcribe the details here later if this is what you want (just want to check before I do a long write up). –  bodhi.zazen Dec 14 '11 at 0:31
    
Just read it. Nice guide and yes that is what I need in this particular case. Little bit sad that, as some comments made in your site, there is not out of the box way of doing this. Some click, add site, done. Anyway I will wait for the guide, test it and let you know bud. –  Luis Alvarado Dec 14 '11 at 0:46

3 Answers 3

up vote 3 down vote accepted

iptables is helpful if it is only a few ip / domain names.

With iptables you can restrict based on user, group, and/or time although to do so you need to use the OUTPUT table. So to allow root, and a group "web", use

# this allows root for things such as apt-get
sudo iptables -A OUTPUT -m owner --uid-owner root -j ACCEPT

# this allows users of the group web
# create a group, web, and add users to it to allow access
sudo iptables -A OUTPUT -m owner --gid-owner web -j ACCEPT

# These two rules allow access to port 80 and 443 over the lunch hour
sudo iptables -A OUTPUT -o eth0 -p tcp -m multiport --dports 80,443 -m time --timestart 12:00 --timestop 13:00 -j ACCEPT
sudo iptables -A OUTPUT -o eth0 -p tcp -m multiport --dports 80,443 -j DROP

But as your needs grow more complex, it is helpful to use proxies. For example you can use privoxy (and others) for adblock. Squid adds in filtering and more complex rules (acl or access control lists), but is likely over kill for a home user.

You then make the proxy transparent with iptables

# This allows root
sudo iptables -A OUTPUT -m owner --uid-owner root -j ACCEPT

# This allows privoxy, which serves as adblock
sudo iptables -A OUTPUT -p tcp --dport 80 -m owner --uid-owner privoxy -j ACCEPT

# this blocks direct access to ports 80 to all other users
sudo iptables -A OUTPUT -p tcp --dport 80 -j DROP

# This allows squid to access privoxy (I think squid runs as "proxy")
#sudo iptables -A OUTPUT -o lo -p tcp --dport 8118 -m owner --uid-owner proxy -j ACCEPT

# this rule blocks other users from direct access to privoxy
sudo iptables -A OUTPUT -o lo -p tcp --dport 8118 -j DROP

# Redirect all outgoing traffic on port 80 to squid listening on port 3128
sudo iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner ! --uid-owner privoxy -j REDIRECT --to-port 3128

Now you install and configure privoxy and squid

Ubuntu server guide squid

Ubuntu wiki privoxy

The problem with this method is you then need to install squidguard, configure squid, etc, which would be a long post and better suited to a larger LAN.

share|improve this answer
    
+1 for the knowledge of several uses for iptables. But as mentioned by pacofvf what about domains and specific IPs. For example the example above is simpler to do the objective that they need. Goes to the point as some might say. (Not to say your way is not good. I can learn even more from here.) –  Luis Alvarado Dec 14 '11 at 1:25
    
Well, this is where squid come in ;) I can add an answer for squid configuration later tonight if you wish. –  bodhi.zazen Dec 14 '11 at 1:44
    
Yeah, would be much appreciated. –  Luis Alvarado Dec 14 '11 at 2:11

You could block IP's and domain names with IPTABLES

outgoing example :

iptables -A OUTPUT -p tcp -m string --string "xxx.com" --algo kmp -j DROP

then with a cron job you could block all domains you want at the specifc time you want, and later unblock them

share|improve this answer
    
+1 for the iptables usage pacofvf. –  Luis Alvarado Dec 14 '11 at 0:41
    
Can you also add how to remove the iptable change. For example, in case they want to remove the blocking domain. –  Luis Alvarado Dec 14 '11 at 1:24
    
iptables -D OUTPUT -p tcp -m string --string "xxx.com" --algo kmp -j DROP , but you still need a method to save and restore iptables when you reboot, sudo iptables-save > /etc/iptables.save , you then add iptables-restore < /etc/iptables.save to /etc/rc.local This is getting complex, I posted a graphical solution. –  bodhi.zazen Dec 14 '11 at 3:35
    
@bodhi.zazen cool ! I hadn't heard of moblock before +1 to your answer –  pacofvf Dec 14 '11 at 19:32

I found a better solution for you, moblock , it comes with a blacklist that is updated daily and a graphical configuration tool.

To install it run

sudo add-apt-repository ppa:jre-phoenix/ppa
sudo apt-get update
sudo apt-get install moblock blockcontrol mobloquer

Then run Mobloquer

For additional information see Moblock Home Page (sourceforge)

shot 1

enter image description here

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.