Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a way to define user based rules in iptables, like Active Directory users or custom user list with dynamic IPs?

Here is a project I found but it is not active now so it doesn't work for me. http://www.ufwi.org/

share|improve this question
1  
What are you trying to achieve ? –  Iain Jul 21 '12 at 7:24
    
Write iptables rules based on AD users. –  denizeren Jul 21 '12 at 7:28
    
I haven't heard of any way to achieve this using iptables. There are dedicated firewalls out there that can do it though, but they're not exactly cheap. If you're interested, I can talk to the firewall staff at my company where this has been implemented in the past few months. But like I said, this is not cheap. –  Jenny D Jul 21 '12 at 10:06
add comment

4 Answers

It is possible, but it requires something other than iptables to do the authentication. Smoothwall [bias warning: I work there] use ntlm, kerberos etc. in the web filter or a captive portal to recognise a user:IP pair, which can then trigger particular iptables rules.

Sometimes it is tricky to work out if someone is logged out, or just hasn't reauthenticated in a while, but in general it works well.

share|improve this answer
add comment

If you tell us what you are trying to achieve is a less vague way then we may be able to give you better answers.

Iptables/netfilter works on packets. Packets in general don't have any way to tie them to a particular user. So no, you can't write rules based on particular AD users.

share|improve this answer
    
I want to write rules based on AD users, purpose is users with dynamic IPs will be filtered by their username(users join AD). I know that iptables works on packets and in packets there is no username info. I was just asking a method you know to achieve this type of filtering. Like the link I supplied. Or more common method used that you know. –  denizeren Jul 21 '12 at 8:36
add comment

No, that is not possible using iptables. There are enterprise Firewalls (Checkpoint for example) which are capable of that.

share|improve this answer
add comment

What you're asking for is to use Windows based user accounts for a *nix based system. While that can certainly be done I've yet to learn of a product that provides that facility. It would however be quite feasible to write a program or script that can query Active Directory and update iptables with the resulting data. The basics are no different to using Active Directory authentication for web apps, so you might look for PHP examples to give you a good start.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.