Helo,
kerio WinROute firewall has one interesting feature. This feature allows inserting firewall rules based on username that was used to log into firewall´s web interface. So user insert his username and password into webform, firewall authenticates him against Active Directory and insert predefined rules for ip address the user logged from.

My boss likes this feature so much, that I was charged to find or write linux equivalent.

I do not think that is very big problem, but also it is not trivia task. Especially because we are handling with security

In fact I used similar system in my former job to limit access to internet for specific ip or mac address.

This system uses mysql database, web interface and one php and one bash script. From web interface was I run bash script and this script started php script and then refreshed firewall. The php script loaded from mysql database ip addresse with flag that denies internet access and these ip addresses were written to file called blacklist. Our firewall (shorewall) then denies internet acces for ip addresses listed in blacklist file.

So I have some idea how the future application will work.

I suppose that the application should work this way:
User points his browser to firewall´s web interface and inserts his username and password into webform. Firewall authenticates him/her, modifies iptables rules to suit user´s ip address and isert them.

I also need some script to delete rules after certain amount of inactivity from user´s ip address and when user logs off or close browser

The biggest problem I see is modifying rules according to user´s ip address. I suppose that I will need some php script that will determine user´s ip address and then will run bash script with user´s ip address as parameter. This parameter will be inserted into rules.

I´d like to ask you for your advices, experience and security suggestions.

Is there some already existing open source project that will solve my task ?

Any recomendations are welcome.

Thanks for your posts.

Maybe look into NuFW.

I've never used it, but it seems to do what you want (and more).