>> That sounds good, how can I do that? > > iptables module "owner" handles that stuff, just "man iptables" if > you'll have any trouble. > > iptables -A OUTPUT -m owner --uid-owner someuser -m tcp --dport http -j > REJECT
I brought this to the shorewall list for config advice, but I was told: a) NO PACKET FILTERING FIREWALL (which includes Shorewall) has any notion of domains. So filterinG by domain is a non-starter. b) When referring to packet filters, filtering by user id (e.g., root) can only be done for connections originating from the firewall. See "man shoreall-rules" and read about the USER/GROUP column. Here was my original request: I'd like to restrict the websites one of the computers on my network can access in Firefox. It only needs to access 2 different domain names and I don't want it to be able to access any others. I can restrict it at the router if necessary because the router is a Gentoo system. I think this leaves a squid proxy setup as my only option? - Grant
