Question for iptables.
 

Hi, i have network of 10-15 pc, i want to block some sites with iptables, but allow for 2-3 pc. How to do it?

Depends on your existing rule-set. What have you got? Sanitise output
before posting - don't tell the world your public IP ;}



Cheers,
Tink

Just an idea, but look up Squid Proxy as well :)

Yeah, if by "sites" you mean Web sites, then Squid would be a much better choice than iptables.

To get an idea of what's involved, check out this thread.

Ok, lets say i have rules to block 1.2.3.4 for my network (10 pc), like this:

iptables -A INPUT -s 1.2.3.4 -j DROP

so, how i allow this web site(1.2.3.4) to 1 pc of these 10?

etc. i have squid, but want do it with iptables. And tanks to all.

Use a rule previous to that one with a defined destination... for example.

iptables -I INPUT -s 1.2.3.4 -d 192.168.0.9 -j ACCEPT

Where 192.168.0.9 is the machine you wish to allow to connect to the IP.

Thanks, i'll try it tomorrow.

If this is for your network, why are you using the INPUT chain? If you're doing packet forwarding you're gonna need to do this in the FORWARD chain. Here's an example of what it might look like:Here, the LAN PC with IP 192.168.1.3 is allowed to connect to IP 1.2.3.4 on the WAN side, while al the other PCs are denied access. Keep in mind that a Web site's IP address can change any time, and there can be multiple IPs for a given site, so don't rely on iptables for this sort of thing if you're looking for effective access control measures (use Squid instead).

I now that.


I think that what i need, can't do it with squid. Lets say i have 5 pc(IT dep.) with full rights,have 100 pc with limit rights and have 10 pc(design studio) witch must have full rights, but their boss want they cannot open web sites like facebook,twitter, etc. So, how i do it with squid? I have squid, here is my squid.conf:

mynet.acl - IT dep.
banned.acl - blocked web sites by ip.
block_url.acl - words like porno, sex, etc.
ogranichenaskorost.acl - limit speed

How block specific web sites for these 10 pc?

Did you search LQ? I ask because there's been tons of discussions which show how to achieve this sort of configuration. For example, see this thread. Assuming that what you meant is that those 100 PCs can only browse certain sites (while the 10 PCs will only be blocked from certain sites), then this could fit together like this:

Thanks win32sux for help, you are very patient. I can't believe, but i think this will work. I'll try it now.

My new squid.conf:

Now they can't download, what i miss?

I'm not sure if this is what you're referring to (you didn't state who they are), but the condition I painted in green wouldn't ever happen, as the line I painted in red would have denied access already. The effect would be what you've described, and one possible fix would be to move the green line above the red one. You'll probably want to move the line I painted blue above both of those too (unless your intention is to let them download from the banned sites).

BTW, you've got a bunch of duplicate lines in there which you should clean up.

Yes, it's now working. Thanks win32sux, you are the man. My new squid.conf: