I would recommend a transparent proxy setup, too. This can be done in three steps.
- Squid configuration (so that it will act as a transparent proxy)
- Iptables configuration (configure system as router, then forward all http traffic to Squid)
- Use Squid ACLs to filter your http-request(s)
1. Squid config
Asuming that you are able to install squid and edit your squid.conf, this would be a simple (condensed) sample to enable a transparent http proxy for the network 192.168.111.0/24 and *.222./24.
acl lan src 192.168.111.1 192.168.222.0/24
http_access allow localhost
http_access allow lan
2. Iptables setup
Your DNAT rules would then look like this, asuming that the squid service is running on the default port (3128).
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to 192.168.1.1:3128
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
3. Squid ACLs
Your sample ACL may look like this. Just use the fitting Access Controls for your case.
acl evelrequest url_regex -i ^http(s)://([a-zA-Z]+).hostname.tld/requestpath/.*$
http_access deny evelrequest