How do i block certain LAN IP from accessing Internet?

asoka_ajay · 05-02-2006, 03:00 AM

Good day,

I'm currently using Redhat 9 as my internet gateway. I used simple IP masquerading scripts to enable the internet sharing function. Now, i would like to block certain LAN IP (static LAN IP) from accessing my internet and enable certain websites only to be accessed by my client machines. How can i do this in Redhat 9? Hope someone can guide and assist me on this.

Thank you.

baboooss · 05-02-2006, 03:14 AM

for blocking certain IP you can use iptable/ipchain...
but for filtering URL use any URL filtering software

asoka_ajay · 05-03-2006, 09:54 PM

Thanx for reply baboooss........but maybe u can help me with the script for iptable/ipchain. I used below script to configure my internet sharing:-
------------------------------------------------------------------------------------
#!/bin/sh
iptables=/sbin/iptables

$iptables --flush -t nat

iptables --table nat --append POSTROUTING --out-interface eth1 -j MASQUERADE
iptables --append FORWARD --in-interface eth0 -j ACCEPT
echo 1 > /proc/sys/net/ipv4/ip_forward
------------------------------------------------------------------------------------

I also shall be grateful if you could suggest some url filtering software for redhat 9/linux.

Thank you

~=gr3p=~ · 05-04-2006, 12:11 AM

Quote:

Originally Posted by asoka_ajay

#!/bin/sh
iptables=/sbin/iptables

$iptables --flush -t nat

iptables --table nat --append POSTROUTING --out-interface eth1 -j MASQUERADE
iptables --append FORWARD --in-interface eth0 -j ACCEPT
echo 1 > /proc/sys/net/ipv4/ip_forward

Hey that's easy. Say for example you want explicitly allow IP 192.168.1.2 to access only www.google.com and you want 192.168.1.3 full access to the internet.

So the rules are as follows.

Quote:

iptables -t nat -I POSTROUTING -s 192.168.1.2 -o eth1 -d www.google.com -j MASQUERADE

iptables -t nat -A POSTROUTING -s 192.168.1.3 -o eth1 -j MASQUERADE

iptables -I FORWARD -i eth0 -o eth1 -j ACCEPT

echo 1 > /proc/sys/net/ipv4/ip_forward

thats all. Now just change the default gateway and DNS on you client machine to point to the firewall machine IP address. All other Clients on your LAN will not be able to access internet till you explicitly add the rule in iptables.

vimal · 05-04-2006, 02:55 AM

Hello asoka_ajay,

To deny certain machines from accessing your internet connection, i think you could use the output chain in the gateway.

#iptables -A OUTPUT -s 'IP of the internal machine' -d 0/0 -p tcp -j REJECT ,

To reject certain sites from the client machines, you can add the rule.

#iptables -A OUTPUT -s 'IP of the internal machine' -d 'URL of the site' -p tcp -j REJECT.

Please reply if this don't works. If so reply with more details.

Thanks,,

~=gr3p=~ · 05-04-2006, 03:44 AM

This is not correct way. He has setup a gateway firewall ROUTER.

Quote:

Originally Posted by vimal

Hello asoka_ajay,

To deny certain machines from accessing your internet connection, i think you could use the output chain in the gateway.

#iptables -A OUTPUT -s 'IP of the internal machine' -d 0/0 -p tcp -j REJECT ,

To reject certain sites from the client machines, you can add the rule.

#iptables -A OUTPUT -s 'IP of the internal machine' -d 'URL of the site' -p tcp -j REJECT.

Please reply if this don't works. If so reply with more details.

Thanks,,