How should I limit the Internet access of most systems on my LAN to a few websites and block all the other websites? I would also like to bypass those restrictions for some systems. All systems have static IP addresses.

I have tried Dansguardian+squid in an independent system, but as the users are able to change proxies in their web browsers, that solution can't be implemented. While browsing, I found out that it can be done by using an Ubuntu gateway system in-between the router and LAN.

Equip the gateway system with two network cards: one for the router and the other for the local LAN.

How should I do this?

Please provide enough details.

  • How much do you know about Ubuntu? How much do you know about networking?
    – Fabby
    Dec 4, 2014 at 20:19
  • I am used with command line, but not at all an expert. Regarding networking, knows basic networking skills. I am always an ubuntu enthusiast. Like to explore more. Thanks
    – ATR
    Dec 8, 2014 at 6:00

2 Answers 2


The basic thing to do is to make the squid server the default gateway instead of your Internet router.

Just add an additional network card to the Ubuntu squid bringing it up to 2 network cards: 1 into your LAN and 1 into your network router. The LAN-side now gets the IP address of the default gateway (probably and the WAN-side gets an automatic IP address from the ISP.

That way all of your network traffic passes through the squid server before going out and it can block anything. Just treat it as a normal Ubuntu machine with a firewall and I would advise not to use blacklisting, but just whitelist stuff.

The only difference is that you might need to add a few manual routes for inside your network but the default goes to squid who just drops everything that is not in the white list...

It's as simple as that!


I have configured an Ubuntu system as a gateway between a LAN and an ADSL router. Of the two network cards eth0 is connected to the ADSL router with IP address

The eth0(WAN) interface is configured with the following inputs:

IP -
Gateway -

eth1(LAN) interface is configured with the following inputs:

IP -
Gateway -
DNS - 

Please note the IP address of eth0 is given as the gateway for the other interface eth1. IP is our internal local DNS server which is configured as caching DNS server.

Edit /etc/sysctl.conf file to uncomment the line net.ipv4.ip_forward=1.

Download the webmin package using the following command:

wget http://prdownloads.sourceforge.net/webadmin/webmin_1.720_all.deb

Install the package:

dpkg -i webmin_1.720_all.deb

Login to Webmin using https://server-ip:10000 in your web browser.

enter image description here

Do NAT on eth0 and click Setup firewall.

You can write a shell script to create customized access for systems in LAN.

vim /root/iptables.sh

iptables -F
IP="3 6 7 13 14 17"
for i in `echo $IP`
  # FTP server
  iptables -A FORWARD -s 192.168.0.$i -d -j ACCEPT
  # Mail server
  iptables -A FORWARD -s 192.168.0.$i -d -j ACCEPT
  iptables -A FORWARD -s 192.168.0.$i -j DROP
exit 0

Edit /etc/rc.local to run the script while booting

 /bin/bash /root/iptables.sh 

Or else you can copy the script to /etc/init.d/ and add it to the boot-up scripts by:

sudo update-rc.d keys defaults

iptables -L will list current iptables rules.


  • Don't just link to the website... Copy the essential instructions over from there and then at the end of your message give the link as your source! ;-) This is to prevent external website's pages being moved, ... invalidating your answer (especially as you accepted your own answer!)
    – Fabby
    Dec 12, 2014 at 12:56
  • 1
    The problem with your answer is that although it is 100% correct, it might also become 100% useless if those links are moved, changed, merged into another one or the main site just disappears... :-( Therefore, please edit your answer, and copy the relevant steps from the link into your answer, thereby guaranteeing your answer for 100% of the lifetime of this site! ;-) You can always leave the link in at the bottom of your answer as a source for your material... Then drop me another note and I'll upvote!
    – Fabby
    Jul 24, 2015 at 9:13
  • @Fabby I have edited as per your advice :-).
    – ATR
    Jul 24, 2015 at 10:58
  • I have upvoted as promised! And the edit is free of charge! ;-) Пожалуйста...
    – Fabby
    Jul 24, 2015 at 11:03

Not the answer you're looking for? Browse other questions tagged or ask your own question.