Toggle HTTP traffic to desired domains using iptables (For hardened systems that don't need to communicate with the outside world, but may need updates/packages)

iptables_toggle_http.sh

#!/bin/bash
enable_http=-1
chain_out="HTTP_OUTPUT"

while [ -v 1 ]; do
   case $1 in 	
	-E | --enable)
	   enable_http=1	
	;;
	-D | --disable)
	   enable_http=0
	;;	
   esac

   shift 
done

if [ $enable_http -eq -1 ]; then 
    echo "You need to pass --enable or --disable."
    exit
fi

function delete_chain 
{
   iptables -D OUTPUT -j "$chain_out" 2> /dev/null
   iptables -F "$chain_out" 2> /dev/null
   iptables -X "$chain_out" 2> /dev/null
}

function create_chain 
{
   iptables -N "$chain_out"
   iptables -C OUTPUT -j "$chain_out" 2> /dev/null
   if [ $? -eq 1 ]; then 
      iptables -A OUTPUT -j "$chain_out"
   fi
}

function a_dns # Accept dns  
{
   iptables -A "$chain_out" -p udp -m udp --dport 53 -j ACCEPT
}

function a_domain # Accept a domain
{
   ip=$(getent ahosts $1 | awk 'NR==1 { print $1 }')
   iptables -A "$chain_out" -p tcp -m tcp -d "$ip" --match multiport --dports 80,443 -j ACCEPT
}

if [ $enable_http -eq 1 ]; then 
   echo "Enabling HTTP traffic."
 
   delete_chain
   create_chain

   # add your rules here
   a_dns 
   a_domain "deb.debian.org"
else
   echo "Disabling HTTP traffic."
   delete_chain
fi