2

This question popped a couple of days ago and it is: How to block, deny or redirect an IP address or domain name to another IP or web domain without the use of a router or configuring a browser. Basically using only Ubuntu to do this.

For example, a user uses a computer, he/she does not have access to facebook or twitter (could be a denied access forever or just between 2pm to 8pm). If the user tries to enter facebook or twitter it will be redirected to another place or just plained canceled.

The program would be preferable in GUI but if there isn't terminal will do.

I have checked out for example ufw and gufw but it only works for programs and ports. The case about domain names is not there. Which would make it easier to select or deselect a domain.

4
  • I think what you want is a transparent proxy. squid is a classic. See debian-administration.org/articles/71 If that is what you want , I can write it up. The main components are a gateway, iptables, and configuration of squid.
    – Panther
    Dec 14, 2011 at 0:17
  • Thanks bodhi. Just in case take into account that this should be done from the same PC and not with a server in the middle or something. Dec 14, 2011 at 0:27
  • OK, you would simply add your proxy, squid, dansguardian, on the local box, and re-direct with iptables. would you please take a look at this, blog.bodhizazen.net/linux/how-to-transparent-proxy , I can transcribe the details here later if this is what you want (just want to check before I do a long write up).
    – Panther
    Dec 14, 2011 at 0:31
  • Just read it. Nice guide and yes that is what I need in this particular case. Little bit sad that, as some comments made in your site, there is not out of the box way of doing this. Some click, add site, done. Anyway I will wait for the guide, test it and let you know bud. Dec 14, 2011 at 0:46

5 Answers 5

3

iptables is helpful if it is only a few ip / domain names.

With iptables you can restrict based on user, group, and/or time although to do so you need to use the OUTPUT table. So to allow root, and a group "web", use

# this allows root for things such as apt-get
sudo iptables -A OUTPUT -m owner --uid-owner root -j ACCEPT

# this allows users of the group web
# create a group, web, and add users to it to allow access
sudo iptables -A OUTPUT -m owner --gid-owner web -j ACCEPT

# These two rules allow access to port 80 and 443 over the lunch hour
sudo iptables -A OUTPUT -o eth0 -p tcp -m multiport --dports 80,443 -m time --timestart 12:00 --timestop 13:00 -j ACCEPT
sudo iptables -A OUTPUT -o eth0 -p tcp -m multiport --dports 80,443 -j DROP

But as your needs grow more complex, it is helpful to use proxies. For example you can use privoxy (and others) for adblock. Squid adds in filtering and more complex rules (acl or access control lists), but is likely over kill for a home user.

You then make the proxy transparent with iptables

# This allows root
sudo iptables -A OUTPUT -m owner --uid-owner root -j ACCEPT

# This allows privoxy, which serves as adblock
sudo iptables -A OUTPUT -p tcp --dport 80 -m owner --uid-owner privoxy -j ACCEPT

# this blocks direct access to ports 80 to all other users
sudo iptables -A OUTPUT -p tcp --dport 80 -j DROP

# This allows squid to access privoxy (I think squid runs as "proxy")
#sudo iptables -A OUTPUT -o lo -p tcp --dport 8118 -m owner --uid-owner proxy -j ACCEPT

# this rule blocks other users from direct access to privoxy
sudo iptables -A OUTPUT -o lo -p tcp --dport 8118 -j DROP

# Redirect all outgoing traffic on port 80 to squid listening on port 3128
sudo iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner ! --uid-owner privoxy -j REDIRECT --to-port 3128

Now you install and configure privoxy and squid

Ubuntu server guide squid

Ubuntu wiki privoxy

The problem with this method is you then need to install squidguard, configure squid, etc, which would be a long post and better suited to a larger LAN.

3
  • 1
    +1 for the knowledge of several uses for iptables. But as mentioned by pacofvf what about domains and specific IPs. For example the example above is simpler to do the objective that they need. Goes to the point as some might say. (Not to say your way is not good. I can learn even more from here.) Dec 14, 2011 at 1:25
  • Well, this is where squid come in ;) I can add an answer for squid configuration later tonight if you wish.
    – Panther
    Dec 14, 2011 at 1:44
  • Yeah, would be much appreciated. Dec 14, 2011 at 2:11
2

I found a better solution for you, moblock , it comes with a blacklist that is updated daily and a graphical configuration tool.

To install it run

sudo add-apt-repository ppa:jre-phoenix/ppa
sudo apt-get update
sudo apt-get install moblock blockcontrol mobloquer

Then run Mobloquer

For additional information see Moblock Home Page (sourceforge)

shot 1

enter image description here

1

You could block IP's and domain names with IPTABLES

outgoing example :

iptables -A OUTPUT -p tcp -m string --string "xxx.com" --algo kmp -j DROP

then with a cron job you could block all domains you want at the specifc time you want, and later unblock them

3
  • Can you also add how to remove the iptable change. For example, in case they want to remove the blocking domain. Dec 14, 2011 at 1:24
  • iptables -D OUTPUT -p tcp -m string --string "xxx.com" --algo kmp -j DROP , but you still need a method to save and restore iptables when you reboot, sudo iptables-save > /etc/iptables.save , you then add iptables-restore < /etc/iptables.save to /etc/rc.local This is getting complex, I posted a graphical solution.
    – Panther
    Dec 14, 2011 at 3:35
  • @bodhi.zazen cool ! I hadn't heard of moblock before +1 to your answer Dec 14, 2011 at 19:32
0

It may arise due to several conditions at which you may require to block or restrict any specific IP address or domain from access of your server. It’s a simple process and by following these instructions you can block the website domain in Ubuntu. As we know Ubuntu is an open source command based operating system that’s why you would have to go through input chain of MASQUERADE rule and trigger below command:

iptables -I INPUT –s <desired ip address> -j DROP

for example you want to block 160.10.11.01 than type:

iptables -I Input –s <160.10.11.01> -j DROP

If you want to block entire IP addresses starting from 160…* than

iptables -I Input –s <160.0.0.0> -j DROP

If still any problem strikes then it would be better to contact any web host or expert domain registrar.

0

I have found firestarter quite a good GUI interface for managing iptables entries.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .