LCE: Challenges for Linux networking

You simply create real-input-company and real-input-internetcafe and ... rules, then redirect everything from INPUT to real-input-whatever.

Switching between rulesets is an atomic "delete old redirect, insert new"; do this for all built-in rules, commit". Not exactly rocket science.

The interesting bit is, of course, per-application routing ("no, online games may not use the company WLAN") or even per-connection routing (i.e. "keep the existing connections on the old default route, but run everything else on the new route"). We can't do that. Yet. (Owner rules might work on Android, but not on a desktop where everything runs as the same user.)