iptables to block Internet access

[Wayne Whibley]

Using iptables I want to block access to all Internet sites but 1, can anyone please help with a rule or a set of rules to do this.
My configuration is simple one network card connected to the LAN 192.168.1.0 and one network card connected to the Internet with a perminant IP address, I only want to users on the LAN to have access to 1 Internet site.

[mdwatts]

Sorry as since I've never used IPTables, I cannot offer much to help.

We do have a IPtables_basics JL Help file that may get you started.

http://justlinux.com/nhf/Security/IPtables_Basics.html

Does your distro include some sort of security setup utility that will guide you through setting up a custom IPtables script?

Any of our IPtables experts can offer assistance? Thanks.

[jumpedintothefire]

That is easy, have you seen some scripts with something like this:

iptables -t nat -A POSTROUTING -s $LAN_IP_NET -j MASQUERADE
iptables -A FORWARD -j ACCEPT -i $LAN_NIC -s $LAN_IP_NET
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT


just do this:

# enable Masquerade and forwarding
iptables -t nat -A POSTROUTING -s $LAN_IP_NET -j MASQUERADE
iptables -A FORWARD -j ACCEPT -i $LAN_NIC -s $LAN_IP_NET -d $ALLOWEDWWW
iptables -A FORWARD -j ACCEPT -i $LAN_NIC -s $LAN_IP_NET -d $ALLOWEDNS
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

The -d states the destition of the traffic, you could further limit this by using the ports also.