-1

I want only - www.thinkwell.com website to be accessed and want to disable all other website access. I am using fedora core 19.

Here are the steps, I tried doing it, but it turned out to be that there is no website access.

First, I got the IP of the thinkwell.com

$ host www.thinkwell.com
www.thinkwell.com is an alias for thinkwell.com.
thinkwell.com has address 207.207.4.196
thinkwell.com mail is handled by 30 aspmx4.googlemail.com.
thinkwell.com mail is handled by 20 alt2.aspmx.l.google.com.
thinkwell.com mail is handled by 30 aspmx3.googlemail.com.
thinkwell.com mail is handled by 30 aspmx5.googlemail.com.
thinkwell.com mail is handled by 20 alt1.aspmx.l.google.com.
thinkwell.com mail is handled by 30 aspmx2.googlemail.com.
thinkwell.com mail is handled by 10 aspmx.l.google.com.

Now, here are the rules I tried.

#iptables -A OUTPUT -p all --destination 207.207.4.196  -j ACCEPT
#iptables -A OUTPUT -p all -j REJECT
#iptables-save

However, the result is that I am unable to access any website. Please tell me what is wrong here? I am accepting only destination output for the IP 207.207.4.196. However, I am rejecting other IP's. I am using router at home. Is it related to it?

2
  • 2
    I might be wrong, but you reject all outgoing request including DNS, so your browser just cant get ip address of www.thinkwell.com
    – Alexey Ten
    Mar 27, 2014 at 7:12
  • @alexeyten: It's difficult to tell without seeing the full OUTPUT table but it looks like that's what they've done.
    – user9517
    Mar 27, 2014 at 7:25

1 Answer 1

3

There are probably better ways to do this using a proxy like squid but if you're going to do it via iptables then think about what you're doing.

You want to allow access to one website and block all others, you need to allow outgoing connections to this website.

Under normal circumstances you would contact a website on port 80 (http) and/or port 443 (https) so you need to allow those destination ports for just the IP address of the website. For all other IP addresses, connections to a destination port of 80 or 443 should be dropped.

You only want to block destination ports 80 and 443 in OUTPUT as, as you've found other things break if you don't.

Your OUTPUT rules could be

  • Allow connections to site if IP is correct and destination port is 80
  • Allow connections to site if IP is correct and destination port is 443
  • REJECT connections if destination port is 80
  • REJECT connections if destination port is 443

You can combine multiple destination ports into a single rule if you want.

Note that the order of the rules is important as iptables will stop processing the packet at the earliest opportunity.

You should probably spend some time reading and understanding the documentation.

Not the answer you're looking for? Browse other questions tagged or ask your own question.