Re: Newbie Question -forcing to pass in squid

["hare ram" <hareram@sol.net.in>]

yes thats true
better u deny all going directly
deny them all who want to go directly in the rule
allow them who are going through the proxy

best of luck
hare
----- Original Message -----
From: "Kevin Saenz" <ksaenz@citistreet.com.au>
To: "Flávio Brito" <flavio@gral.com.br>; <netfilter@lists.netfilter.org>
Sent: Monday, October 14, 2002 10:16 AM
Subject: RE: Newbie Question -forcing to pass in squid


I guess there are a few things I can see here, there are a number of
solutions for this problem.

first you deny web access to all but one machine, through the firewall.
This will stop users from cheating by removing the proxy settings.

second, you could also install squid on your firewall and allow the users
through that

-----Original Message-----
From: Flávio Brito [mailto:flavio@gral.com.br]
Sent: Monday, October 14, 2002 12:03 PM
To: netfilter@lists.netfilter.org
Subject: Newbie Question -forcing to pass in squid



Dear Friends

I have two machines, and I trying to force all port 80 traffic to pass
in SQUID 3128. But when people unset proxy in browser, they bypass SQUID
to the Internet . I cannot put transparent proxy, because SQUID is
authenticating.

Suggestions?

Thanks

Flávio
----------------------------------------------------------------------

FW
|-------------------------------|
| eth0 - 200.1.2.3 |----------------------> [INTERNET]
| eth1 - 192.168.1.1 |
|-------------------------------|
|
|
SQUID
|
|-------------------------------|
| eth0 - 192.168.1.33 |
|-------------------------------|
|
|
INTERNAL_LAN
|
|-------------------------------|
| 192.168.1.0/24 |
|-------------------------------|


My Example


iptables -F
iptables -A INPUT -i lo -p all -j ACCEPT                    #   - Allow
self access by loopback interface
iptables -A OUTPUT -o lo -p all -j ACCEPT
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
#- Accept established connections
iptables -A FORWARD -o eth0 -j ACCEPT
iptables -t nat -A POSTROUTING -s $INTERNAL_NET -o $EXT -j MASQUERADE
iptables -t nat -A PREROUTING -p tcp --dport 80 -j ACCEPT  -d
192.168.1.33
iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT
--to-port 3128