I have 15 agents with thin clients running with Ubuntu Mate 18.04 and ltsp installed on server. I dont want my agents to have access to anywhere but 3 websites.

  • I have already tried ip tables but had 2 problems. It slowed down my thin clients and it was back to default after each reboot.
  • Browser extensions also don't work for me. First I have to set them up on each thin client and. anyway, I believe my agents are smarter than that.
  • I dont know why but /etc/hosts.deny and /etc/hosts.allow don't apply any changes.
  • /etc/hosts does make changes, but that gives me a blacklist for some websites while what I need is a whitelist.
  • I can't change the router settings because some other people with different usage work in the morning shift and they need full access. as far as I know since we are dealing with voice rejecting a port is not a good idea and we better block URLs
  • Since I want to hire more agents and I want them focused on their job, I really need something permanent.
  • I also think blocking all traffic via squid proxy is not the best idea but I have not tried that

2 Answers 2


I managed to find my answer(my boss(my uncle) actually) do as follows if you had same problem

 vim /etc/netplan/01-network-manager-all.yaml

then comment nameservers and addresses

now websites and even google can't be accessed

in following direction we can have our whitelist

vim /etc/hosts

now insert website ip and website DNS with one space between

websiteip websitename.com


While all the browser processes are runing on the server you need to install the restrictions there. If you set up the iptables configuration to be installed at every boot (on the server: like write all the commands in /etc/rc.local) it should be enough, unless the terminal users have root access on the server.

For scenarios like this denying all web traffic and setting up a proxy server is the usual solution. This is also your path, if you want different permissions for different URLs on the same webserver IP.

  • ,thanks for your time and answer,as I mentioned I don't think using ip tables is the best idea because it blocks ports while I want URLs to be blocked/but I will test using a proxy server if I didn't get a better answer/thanks again Aug 22, 2019 at 20:52
  • @Ali Taleghani Using proxy is the most common solution, but iptables is a viable option too, and sometimes its even simpler. As i found out in this very minute while browsing the iptables HOWTO, it is possible to create per user rules with the iptables --owner-uid parameter.
    – n3ko
    Aug 23, 2019 at 22:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.