Due to a child protection and safeguarding issue, I want to set up a restricted or limited account for a tech-savvy teenager to use. I would like to whitelist only specific websites (e.g. iPlayer and Netflix since there's no TV in the house) for that user. I'm not concerned about software updates--those will be run through my account, natch.

I understand that the usual answer is to use a proxy such as Squid or Privoxy. However, I'm concerned that it is possible to get around such systems by overriding local proxy settings on the client unless there is a device running them as a transparent proxy, filtering all local network traffic. I'm also concerned about the technical burden of administering and maintaining one. (That's speaking as a systems administrator.)

I would ideally like to be able to use my admin account, which obviously has sudo, to set local firewall rules on a per-user basis. I would have thought it fairly trivial in theory for to the kernel's network stack to block connections based on which local user process they originate from just as it is capable of blocking outgoing connections from certain hosts or ports, and would be easier to administer and maintain than a proxy, even if the kernel itself does not in fact offer said functionality and that that would seem to be a much more elegant and efficient mechanism than the sledgehammer of a border device blocking by host or running a proxy.

Does anyone have any thoughts on the matter?

Edit: people who are downvoting, could you explain why in the comments?

1 Answer 1


Well, to be honest, there is a reason why everyone gives the usual answer to use a proxy. It is far more simple to administer than a set of IP filters on a host. It also works cross-device, so if this teenager uses his phone on the wifi-network, he will get the same protection.

If you want to make sure that everyone uses the proxy, create a DMZ where the proxy is located and do not allow direct access to the Internet. This can easily be done with two simple NAT routers. There is always a downside: the more tech-savy the teenager is, the easier it will be to bypass your security measures. And you will probably not want to administer an enterprise solution.


With iptables, it is possible;

iptables -A OUTPUT -o ethX -m owner --uid-owner {USERNAME} -j ACCEPT

where –uid-owner { USERNAME } matches if the packet was created by a process with the given effective USERNAME.

But it will be terrible to administer and therefore A Bad Idea.

  • He doesn't have any access to internet-enabled devices, especially not smart phones. That's a loss of privileges we'd like to slowly restore but trust is a two-way street and letting him watch Netflix is a good way to regain the we (adults, not myself specifically) lost when those privileges were withdrawn. There is only one person on this network at the moment: myself. Forcing all of my devices to use a proxy all of the time is self-defeating. I only want this specific user account on this specific machine to have enforce a website whitelist.
    – DMCoding
    Nov 23, 2018 at 22:33
  • In the future we are looking at an enterprise-grade solution for his home, but in the meantime are you sure there are no linux firewalls which can block packets on a per-user basis? ipfw for example?
    – DMCoding
    Nov 23, 2018 at 22:35
  • corrected my answer. Nov 24, 2018 at 14:29
  • TO improve upon the above, I believe that both firewalld (which itself uses iptables) and ipfw (BSD) offer this functionality as well. @Ljm Dullaart Why will it be difficult to administer?
    – DMCoding
    Nov 24, 2018 at 17:18
  • If you give access to one site, that's easy. Oh yeah, another site, oh yeah and yet another. So you need a process where your teenager can request an URL, which you will need to screen. Before you know it, you're looking at all sorts of sites the whole day, and hm... maybe we should limit the requests that can be made to, say, 5 URL's per day? Here in NL, some homework may require searching through the Internet; will you be present allways for his homework, to add the URL's to the IP filter-list? Nov 24, 2018 at 18:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.