1

We can insert iptables rules based on IP/Network/Hostname:

iptables -t filter -A OUTPUT -p tcp -d www.google.com -j ACCEPT -m comment --comment "www.google.com" 

It is not accepting:

iptables v1.4.7: host/network www.google.com not found
Try iptables -h' or 'iptables --help' for more information.
5
  • main aim is user should be allowed to surf only assigned websites. – user3134198 Mar 29 '14 at 14:14
  • Edit your question instead of putting additional information in comments. – Hauke Laging Mar 29 '14 at 14:20
  • What does "it is not accepting" mean? You should always give the output of iptables -L -nv when explaining a Netfilter (iptables) problem. – Hauke Laging Mar 29 '14 at 14:25
  • I'm wrong! You can use a domain name -- my bad, so I've deleted my answer. – goldilocks Mar 29 '14 at 14:39
  • # iptables -t filter -A OUTPUT -p tcp -d www.google.com -j ACCEPT -m comment --comment www.google.com iptables v1.4.7: host/network www.google.com not found Try iptables -h or iptables --help for more information. I am executing above command and returns the below error. – user3134198 Mar 29 '14 at 14:45
0

host/network www.google.com not found

Presumably you're doing this either before configuring DNS, or while your firewall configuration is blocking DNS.

In any case, you're using the wrong tool for the job. You're trying to drive in a screw with a hammer. Even if you manage to get something done, I wouldn't sit on that chair.

For this example, it won't work: www.google.com has many IP addresses, and a given DNS lookup returns only a few of them. You can't easily enumerate all the IP addresses of www.google.com. So your requests to www.google.com will randomly get through or not. Conversely, many sites that are smaller than Google operate out of the same IP address, so you could only block all or none of them.

In order to filter web access, you need a web proxy. In the itables configuration, block all outgoing access except for port 443 (you pretty much can't filter HTTPS anyway, except in an invasive and insecure way which I will not go into in this answer) and except for the user running the proxy.

iptables -P OUTPUT DROP
iptables -A OUTPUT -p icmp -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp -m owner --uid-owner wwwproxy -j ACCEPT

Replace wwwproxy by the name of the user running the HTTP proxy, which will depend on your proxy configuration.

There are many HTTP proxies out there. Squid is popular, but for a small installation you might prefer something smaller.

4
  • When iptables chains are on DROP policy and adding rule returns error: iptables -F iptables -P OUTPUT DROP iptables -P INPUT DROP iptables -P FORWARD DROP iptables -t filter -I OUTPUT -d www.google.com -j ACCEPT -m comment --comment "www.google.com" it returns error ` iptables v1.4.7: host/network www.google.com' not found Try iptables -h' or 'iptables --help' for more information.` – user3134198 Mar 30 '14 at 14:56
  • On other hand when iptables policies are ACCEPTING and adding allows iptables -F iptables -P INPUT ACCEPT iptables -P OUTPUT ACCEPT iptables -P FORWARD ACCEPT iptables -t filter -I OUTPUT -d www.google.com -j ACCEPT -m comment --comment "www.google.com" – user3134198 Mar 30 '14 at 15:01
  • Please someone can help me to understand the difference between this two scenario – user3134198 Mar 30 '14 at 15:02
  • @user3134198 With a DROP policy, you're blocking DNS requests, so when iptables makes a DNS request to find the IP address of www.google.com, it doesn't get an answer. With an ACCEPT policy, the DNS gets through, but although there is no error, the result isn't what you want, as I explain in my answer. – Gilles 'SO- stop being evil' Mar 30 '14 at 15:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.