Extremely low ram proxy

[Ulysses_]

Objective is to block all sites except youtube.com.  A firewall only blocks ip's, and youtube ip's are variable.  So a proxy is recommended instead, configured to block DNS lookups to anything but youtube.com.  But available ram is very limited.

Does an extremely low ram proxy exist for TC?  Like 32 MB or even less, with TC in scatter mode?

Can this simple task better be implemented by rebuilding TC after adding a line or two of C code somewhere in the TC sources?

[yoshi314]

1. erase /etc/resolv.conf
2. add youtube.com entry to /etc/hosts
3. success.

[Ulysses_]

Good point, thanks.

What if the TC machine is to provide internet access to other machines in a LAN?  Is there some low-ram trick to make TC only allow some domain names?

[danielibarnes]

DNSMasq can do what you need.

[Ulysses_]

What if a link like this is clicked at or otherwise downloaded?

[gerald_clark]

That is not a domain name.

[danielibarnes]

What if a link like this is clicked at or otherwise downloaded?

iptables is the tool for that job.

[Ulysses_]

But you don't know what IPs to allow while blocking all else.  If only domain names had one IP each, you'd simply add an iptables allow rule for youtube's IP while iptables is blocking all else.  But youtube.com has several IP's and they may change.  

Has anyone thought of something like rebuilding dnsmasq with a few more lines of C code so it generates iptables rules after every successful DNS query?

[gerald_clark]

You generally use iptables to block incomming connections, not outgoing.

[danielibarnes]

You generally use iptables to block incoming connections, not outgoing.

Works for either.

Objective is to block all sites except youtube.com

I believe I have a dnsmasq solution for this. I will test it out and post results.

[danielibarnes]

The upstream DNS server for both examples is 192.168.1.2. Execute "dnsmasq -R -C dnsmasq.conf"

Single machine setup:
IP: 192.168.1.128
/etc/resolv.conf
nameserver 127.0.0.1
dnsmasq.conf
server=/youtube.com/192.168.1.2

Client/Server setup:
Server
IP:192.168.1.128
dnsmasq.conf
server=/youtube.com/192.168.1.2
Client
IP: 192.168.1.129
/etc/resolv.conf
nameserver 192.168.1.128

nslookup for a host on any domain other than youtube.com fails. If you need additional details, just ask.

[Ulysses_]

Don't forget to include this domain name too: ytimg.com.  It is required by youtube.com in order to show videos, so says the NoScript addon:

[danielibarnes]

Don't forget to include this domain name too: ytimg.com.  It is required by youtube.com in order to show videos, so says the NoScript addon:

You can just add an additional line to dnsmasq.conf:
server=/ytimg.com/192.168.1.2

[Ulysses_]

Are you doing something about the danger of malicious links that specify IP instead of domain name so no dns query is generated?

[Ulysses_]

Just had a brainwave. Can dnsmasq associate a fixed IP with youtube.com and ignore upstream dns servers?