I have a Debian server that allows users to log in. I don't mind them accessing the web or downloading files, but I want to otherwise restrict their internet access from that machine. How should I set up my IPTABLES or other firewall to make this work easily?


This is actually extremely tricky from a technical perspective (the network layer doesn't usually know anything about users; there is no "user" field in a network packet).

But, Linux, being totally awesome, does have a solution for you. You'll need the iptables "owner" module, and rules along the lines of this:

iptables -A OUTPUT -o eth0 -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -o eth0 -m owner --uid-owner 500 -j DROP

Where "500" is the UID of the user you'd like to block from hitting the net. The first rule just allows all outbound port 80 traffic.

You probably need to load the owner module before this will work:

modprobe ipt_owner

So, add that to your rc.local file, or similar. This assumes, of course, that your system has this module installed. I don't know what package provides it on Debian. It might be in the standard iptables package.

  • Yes, the owner module can do it. You could also block outbound traffic from processes whose group id is not some group you've authorised. – MarkR Jun 3 '09 at 20:28
  • The owner module only works for locally generated packets, not forwarded packets. So it won't do what your claiming. – David Aug 4 '09 at 1:56
  • OP is talking about locally generated packets, isn't he? He said "I have a Debian server that allows users to log in". I assumed that meant the users are local. – swelljoe Aug 18 '09 at 0:47

Another option is to configure a proxy server (Squid) somewhere that allows general anonymous internet access but requires a login to do anything else. Then block access from your server at the firewall but allow the proxy through.

If you only have one machine, I would echo swelljoe's suggestion. Or combine the two ideas and make everything more granular if you prefer :)


I would suspect you would simply block all inbound and outbound ports for the host except for ports 22 (ssh) and 80 (web). If you're using this computer for your own as well as helping out some friends learn, and require things like email, instant messeging, etc I would recommend creating a special group just for them that can only access a specific list of applications. I think you may need to specify if this is a stand alone server or a workstation for you + a server for them.


You can use a SELinux policy for this, but unfortunately it's a bit more complicated to set it up than the iptables solution.


I did this once using a combination of squid and "name" - a really old linux/unix service that provides the current username. Generally speaking, name is a really really bad idea (as its unencrypted and you can modifiy it pretty easy; it's used by irc btw) but for a known set of machines, it works pretty well


Your looking for a proxy, along with iptables rules. Use iptables to restrict port access and redirect traffic to the proxy. In the proxy you filter the content you do/don't want getting through. (The owner module only works for packets created on the firewall itself, not the packets coming from your network.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.