I setup a Raspberry Pi connecting to my home router using the eth0 interface and broadcast a SSID via wlan0 interface simply by installing the RaspAP (https://raspap.com).

Everything working as expected.

However, I would like this newly created SSID only allow device to access a specific IP address (e.g. for my kids' school web server).

I tried to configure the UFW rules

sudo ufw default deny outgoing

sudo ufw allow from to

I found that the rule only applies to the pi itself but the iPad can still access anywhere.

Any thoughts is welcome.

2 Answers 2


I do not use ufw so I don't know how to use it. But it is a front-end for iptables, to make managing a Netfilter firewall easier. With iptables you can define rules for the INPUT, OUTPUT and FORWARD chains. You are using

sudo ufw default deny outgoing

that should be a rule for the OUTPUT chain. You have to use rules for the FORWARD chain. Look at the synonym for the ufw rule.


Use dnsmasq to whitelist the domains/IPs you want and deny access to everything else. Edit the file /etc/dnsmasq.d/090_raspap.conf and add the following:


The address line tells dnsmasq to redirect all sites to localhost. The server directive makes only certain sites use Quad9's DNS server at You can add any number of these server lines to build a custom whitelist.

Restart dnsmasq with RaspAP or from the shell and check its status:

sudo systemctl restart dnsmasq.service
sudo systemctl status dnsmasq.service

Connect a client to the AP and confirm that your whitelist works.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.