Ubuntu: block access sites through internet gateway

Typically there are two reasons I see this done.

• As Robert Kaucher mentioned, content filtering, logging, and enforcement at the "hub site" is one big reason. Many content filtering products allow "slave" servers to be deployed at remote sites to perform filtering and logging based on a central "policy server". For a remote site where there isn't any server computer, though, and organization might just opt to route all that traffic back to a central filtering server.

• Centralized firewall rules and monitoring are another common reason I've seen this done (for user-to-site VPNs in particular, but I've seen it with site-to-site, too). "Split tunneling" (that is, allowing the remote VPN endpoint to directly communicate with the Internet and sending only traffic to the corporate network down the VPN pipe) is seen by some as a major security risk. In a site-to-site environment, you could make the call that the firewall in the remote office should be configured to allow safe direct Internet access, but I've seen situations where it was considered "better" (I suppose because the firewall rules at the remote site ended up being, basically, "allow VPN traffic only") to route all that Internet traffic to the "hub" site.

You should see an improvement in bandwidth utilization at the "hub" site, and improved responsiveness at the remote site by moving to a split tunnel. As long as you've got solid firewall rules in the remote site (and whatever monitoring infrastructure, content filter, etc that you want) there shouldn't be any reason not to allow it to have direct Internet access and save bandwidth at the "hub" site.

I'm a little embarrassed to admit that I've done this before, but the "cheapest" way I've found to do this (assuming the user can't install or otherwise use third-party web browser software) is to use Group Policy to configure Internet Explorer, for the offending user, to use a bogus HTTP / HTTPS proxy server (i.e. an IP / port that doesn't answer-- preferably one that actually rejects the TCP connection attempt). I put "permitted" web sites into the proxy bypass list.

It's a very "cheap" way to do what you're looking for and utterly easy to bypass if the user can install or use third-party browser software.

One "righter" way to do this would be to force outbound HTTP / HTTPS through a proxy server that allows for per-user ACLs. Squid with NTLM authentication can do this with no software licensing cost and can provide a fairly nice transparent authentication experience for domain-joined Windows machines accessing web sites through it.