Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

May I have an example of an bash script that uses iptables to only allow access to two websites ?

I want to use it in order to have a whitelist locally and restrict my access to the web to a limited set of places.

I want to run this on my workstation(my desktop computer)

Thanks

share|improve this question

closed as not constructive by John Gardeniers, Brent Pabst, rnxrx, Ward, Scott Pack Sep 30 '12 at 1:05

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance. If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer 1

You wouldn't typically do this with iptables you would use something like squid proxy with a suitable acl e.g.

acl OKSites dstdomain "/usr/local/etc/allowed-sites.squid"

#
# Add this at the top of the http_access section of squid.conf
#
http_access allow OKSites
http_access deny all

Where the allowed-sites.squid file contains a list of allowed sites

google.com
oterhdomain.co.uk

If you really must do this with iptables then

# deny everything
iptables -P OUTPUT DROP

# Allow DNS
iptables -I OUPUT -p udp --dport 53 -j ACCEPT

iptables -I OUTPUT -p tcp -d serverfault.com --dport 80 -j ACCEPT
iptables -I OUTPUT -p tcp -d stackoverflow.com --dport 80 -j ACCEPT

would allow access to DNS. Be aware that, using this method the IP address of the site is only updated when the rule is added to the filter. If the IP address of the site changes then access will be enabled agai so you'd need to reload the rules.

share|improve this answer
    
does it make sense to have a squid locally on my workstation ? –  average Sep 27 '12 at 13:55
    
I tried the method you indicated with iptables, and it works ! Thank you ! But It seems if I rerun it, and try to access serverfault.com from chrome, the request just .. lags, so blank screen and still loading. if I curl serverfault.com it works on the commandline but the browser doesn't want to load the page. if I do /etc/init.d/networking restart while the page is loading, the page loads in chrome also.. but that's just for one page, I can't do that each time.. –  average Sep 27 '12 at 13:57

Not the answer you're looking for? Browse other questions tagged or ask your own question.