Hi all, was hoping someone could help me. I have an Ubuntu server running a transparent proxy and would like to restrict specific client machines to browsing only one website during work hours and only allow them unlimited browsing during lunch times, how do i do this, and can it be done without removing the transparent proxy.

thanking you in advance

Try including useful information such as what you're using as the transparent proxy.

thanks for the quick reply, i'm using squid

Ok, so what have you tried so far? A google search for "squid restrict access by time" throws up many, many resources for creating time based ACLs.

I did find options to restrict by time, which I can do, I also found ways of restricting access to specific websites by creating a file with the list of the restricted sites, what I could not find, however, was how to block all sites (obviously I cant list them all) on specific IPs on a network and only allow access to one website.

I have to say replies on this forum are quite fast, many thanks.

Or maybe, is it possible if using squid would be a bit complicated to redirect all outgoing web traffic on those specific IPs to the particular website thats allowed access by using iptables

So you need two ACLs and apply them in the following order:

1. allow the source machine(s) access to everything but with a time "windows".
2. allow the source machines(a) access only the specific site (by IP of the site or by dstdomain).

So what will happen is that during "happy hour" the time condition of the first ACL will match, so it'll be "active". When it's outside the "happy hour" the request will fall through to the next ACL where it'll only allow access to the matching IP or dstdomain or whatever other combinations you put in the ACL.

What you may be missing is how to combine conditions. Just give the conditions the same name in the ACL. So the example below creates a "happyhour" ACL that will match between 12:00 and 13:59 (Ok,it's 2 hours, sue me!) AND the client IP is within the given range.

1 members found this post helpful.