Linux: IPChains-like operations but different..

[(Shovel)]

As you can see from the title, my Linux terminology gets better every day... ahem.

Right, here's the situation, I hope maybe someone can offer advice on where to go.

My home network (which isn't set up yet, I don't go home for a week yet, this thread is purely pre-emptive) needs some slightly deeper configuration than I'd originally planned.

We have a conventional set up, wires into one switch from three external machines.

Now, the complication is that Mum doesn't want my younger brother to have Internet access from his bedroom. However, we can see the benefits (*cough* games *cough*) of him having network access. On top of this, I'd like him to have access to WindowsUpdate, Office Update and the Symantec Virus updates site so that his computer can be kept secure. However, everything else - MSN Messenger, IRC and every other website are out. I don't know about email yet, but this is conseptual, so it doesn't matter.

I've been reading up on IPCHAINs, which is all well and clever, and assuming that internal computers keep the same IP address it would just about work. However, I'd like to be able to match him up to host names on particular protocols (e.g. "*.microsoft.com" on HTTP and FTP) which I've established you *can't* do with IPCHAINs. Or at least, none of the documentation I've read has done it.

My obvious conclusion is that some other part of the Linux system can be used for this kind of filtering - but, frankly, I've not idea which.

*/me grovels for more help*

Thank you

 

[Testin da Cable]

um been ages since I've used linux, but I'll try

ipchains -P input DENY
ipchains -P forward ACCEPT
ipchains -P output ACCEPT
ipchains -A input -s ! <BRO's IP> -d 0/0 -p 6 -j ACCEPT
ipchains -A input -s ! <BRO's IP> -d 0/0 -p 17 -j ACCEPT
ipchains -A input -s <BRO's IP> -d <MS's IP> -p 6 -j ACCEPT
ipchains -A input -s <BRO's IP> -d <MS's IP> -p 17 -j ACCEPT
ipchains -A input -s <BRO's IP> -d <SYMANTEC's IP> -p 6 -j ACCEPT
ipchains -A input -s <BRO's IP> -d <SYMANTEC's IP> -p 17 -j ACCEPT
ipchains -A input -p TCP -s <BRO's IP> pop3 -d <pop3 server> -j ACCEPT
ipchains -A input -p TCP -s <BRO's IP> smtp -d <smtp server>  -j ACCEPT

something like that

 

[(Shovel)]

Yeah - that's basically what I've got.

The problem as I see it is "what happens if those IPs change? Do I have to reconfigure it? Or am I likely to be safe with them being such big companies?

Thanks TDC

 

[Testin da Cable]

I think you'll be safe really. In this case it would be nice if you could enter dnsnames into the firewall ruleset, but that's (afaik) not possible and actually bad I believe.