I am wondering if some rule like the following can be set up at the router level; using iptables or ipset or similar tools. (I am not very experienced in this area, sorry if the following is a bit vague)

Example: I want to Block twitter after 30 minutes of usage (or 200 MB of data) . Reset counter every 24 hours. (I am not looking for schedule-based rules i.e. block twitter from 18:00 to 20:00)

I am assuming I would have to derive the "session" attributes by manual calculation. Can this be done by logging traffic corresponding to that particular website using firewall , and calculating approximate duration using a shell script? Are there easier ways?

I understand comments about this use case not being the best fit for packet-level filtering. But I am not clear how counting packets based on target addresses is much different from, say regular firewall rules for filtering packets based on undesired source addresses.

For context, in other projects: Some probable (but suboptimal) approaches using ipset counters were suggested in the dd-wrt forums. There are some documentation stubs about feature plans for similar quotas, in the squid-cache project as well [wiki.squid-cache.org/Features/Quota]

PS: There are browser extensions (stayfocused , leechblock) that can do this at the application level, but I want to implement this at the router/firewall level because there are no open source solutions that work for all my devices.

  • 1
    From what I know and can find I do not see that as a feature of UFW. – David Mar 3 at 10:59
  • 1
    yes, same for iptables directly. Keep in mind that iptables is directly in the packet level flow, and therefore a lot of computing per packet is highly highly undesirable. – Doug Smythies Mar 3 at 16:34
  • 1
    It has been years since I did comparative throughput tests between ipset and direct iptables rules. Now I can not find the results. I merely made the rule sets ridiculously large and then hammered them with packets that had to traverse the entire rule set only to hit on the last rule, measuring somehow the time delay. – Doug Smythies Mar 8 at 15:58
  • 1
    This is not something available out of the box currently in Ubuntu. You'd need an application-aware firewall with site/fqdn/etc. insights and unfortunately that's a lot higher level of control than you're going to get with iptables or the system itself. If you want to do this at the router level, that's not an Ubuntu question. – Thomas Ward Mar 8 at 16:05
  • 2
    I will point this out, but it's not going to do what you want easily. There are firewall / router platforms that are proprietary out there that can do this, such as Sophos XG Firewall (there's a free 'home' edition) that can be put in place of your routers (you'll nave to redesign your network though if you need wifi) and can handle setting limits for certain access to sites during time of day and blocking otherwise by content policies, but that's a larger issue and not supported here on Ask Ubuntu. – Thomas Ward Mar 8 at 16:06

Based on the comments on the question, there are no out-of-the-box solutions in ubuntu that can do this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.