# iptables Active Directory user based rules

Is there a way to define user based rules in iptables, like Active Directory users or custom user list with dynamic IPs?

Here is a project I found but it is not active now so it doesn't work for me. http://www.ufwi.org/

-
What are you trying to achieve ? –  Iain Jul 21 '12 at 7:24
Write iptables rules based on AD users. –  denizeren Jul 21 '12 at 7:28
I haven't heard of any way to achieve this using iptables. There are dedicated firewalls out there that can do it though, but they're not exactly cheap. If you're interested, I can talk to the firewall staff at my company where this has been implemented in the past few months. But like I said, this is not cheap. –  Jenny D Jul 21 '12 at 10:06

It is possible, but it requires something other than iptables to do the authentication. Smoothwall [bias warning: I work there] use ntlm, kerberos etc. in the web filter or a captive portal to recognise a user:IP pair, which can then trigger particular iptables rules.

Sometimes it is tricky to work out if someone is logged out, or just hasn't reauthenticated in a while, but in general it works well.

-

If you tell us what you are trying to achieve is a less vague way then we may be able to give you better answers.

Iptables/netfilter works on packets. Packets in general don't have any way to tie them to a particular user. So no, you can't write rules based on particular AD users.

-
I want to write rules based on AD users, purpose is users with dynamic IPs will be filtered by their username(users join AD). I know that iptables works on packets and in packets there is no username info. I was just asking a method you know to achieve this type of filtering. Like the link I supplied. Or more common method used that you know. –  denizeren Jul 21 '12 at 8:36

No, that is not possible using iptables. There are enterprise Firewalls (Checkpoint for example) which are capable of that.

-

What you're asking for is to use Windows based user accounts for a *nix based system. While that can certainly be done I've yet to learn of a product that provides that facility. It would however be quite feasible to write a program or script that can query Active Directory and update iptables with the resulting data. The basics are no different to using Active Directory authentication for web apps, so you might look for PHP examples to give you a good start.

-