Re: squid and iptables

["Zé Luís" <zeluis@objetivo-americana.com.br>]

Omar Castaneda Acosta wrote:

> Setup iptables to DROP/REJECT everything from the internal interface
> except -m state NEW,ESTABLISHED,RELATED on every service you want to
> allow.


thanks Omar,

i'm  needing more details about how to exactly do it.

I'm opening just few ports from eth0( NET_INT, my local network) to my 
eth1 firewall (my internet valid ip), like 25,53,80 and 3128 ports.
I do something like this

"iptables -A INPUT -p tcp -j ACCEPT -s 192.168.1.10/255.255.255.0 -i 
eth0 -d 192.168.1.154 --dport nn"

but all traffic is made like this:

Client:
------

from: 192.168.1.10:nn
to: 192.168.1.154:3128 (my firewall, squid server)

Server:
-------
from: 192.168.1.154:3128
to: 0.0.0.0 (Internet)

All client browsers is configurated to work with proxy on port 3128.


How can i filter destination ports requests from clients machines to 
external internet with proxy intercepting this traffic on 3128 port???

Very Thanks again..

Ze Luis

> 
> Hi,
> 
> i have a network with squid authentication on port 3128 and acl's
> controls. My users only surf with password authentication.
> 
> I don't control access port with squid acl. All ports is free by squid.
> 
> But,
> 
> i need control wich ports each machine can access by iptables. Is it
> possible?
> 
> My idea is :
> 
> - squid do not control ports, only url_path, urlpath_regex, time,
> password.
> 
> - iptables open and close ports (from internal mchines to internet) for
> data from proxy and other (telnet, irc, ssh and all other)
> 
> My question:
> 
> - Is it possible.
> 
> if yes:
> 
> - what chain use?
> - a example, plase ;-)
> 
> if no:
> 
> - what's betther way to do this
> 
> 
> Thanks, thanks, thanks.
> 
> Ze Luis