[CentOS] Block internet access for some users on the LAN ?

Mon Sep 18 17:24:11 UTC 2017
Leroy Tennison <leroy at datavoiceint.com>

Iptables is a very reasonable way to do it, basically you decide what devices should have Internet access, create accept rules for them and then have a default deny for everything else.

----- Original Message -----
From: "Nicolas Kovacs" <info at microlinux.fr>
To: "centos" <centos at centos.org>
Sent: Monday, September 18, 2017 12:03:56 PM
Subject: [CentOS] Block internet access for some users on the LAN ?


In our local school we have two servers and roughly 80 clients. The
network is, and DHCP+DNS is managed by Dnsmasq.

School PCs (teachers and management) are registered via MAC address and
get an IP address in a specific range: - - management + teachers - - computer room - - printers - - wireless access points

If a client (like a student's laptop, tablet or smartphone) is not
registered, it gets an IP address in the range between

Up until recently I've been using a combination of Squid and Squidguard
to filter Internet access.

This year the school's director wants to completely block Internet
access for all the student's personal devices.

The Linux server acts as a transparent gateway. Unfortunately with Squid
I can only filter/block HTTP connections, but not HTTPS (well, I could,
but this is way too complicated to setup).

The firewall is managed by a simple Iptables script. Now I *think* the
easiest way to block a certain IP range from Internet access would be
through Iptables (correct me if I'm wrong). If this is the case, what
would that look like?

Any suggestions?

Niki Kovacs

Microlinux - Solutions informatiques durables
7, place de l'église - 30730 Montpezat
Web  : http://www.microlinux.fr
Mail : info at microlinux.fr
Tél. : 04 66 63 10 32
CentOS mailing list
CentOS at centos.org