Newbie Question -forcing to pass in squid

Newbie Question -forcing to pass in squid

[Flávio Brito]

Dear Friends

I have two machines, and I trying to force all port 80 traffic to pass
in SQUID 3128. But when people unset proxy in browser, they bypass SQUID
to the Internet . I cannot put transparent proxy, because SQUID is
authenticating.

Suggestions?

Thanks 

Flávio  
----------------------------------------------------------------------

FW
|-------------------------------|
|	eth0 - 200.1.2.3	|----------------------> [INTERNET]
|	eth1 - 192.168.1.1	|
|-------------------------------|
		|
		|
		SQUID
		|
|-------------------------------|
|	eth0 - 192.168.1.33	|
|-------------------------------|
		|
		|
	INTERNAL_LAN
		|
|-------------------------------|
|	192.168.1.0/24		|
|-------------------------------|


My Example


iptables -F
iptables -A INPUT -i lo -p all -j ACCEPT                    #   - Allow
self access by loopback interface
iptables -A OUTPUT -o lo -p all -j ACCEPT
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
#- Accept established connections
iptables -A FORWARD -o eth0 -j ACCEPT
iptables -t nat -A POSTROUTING -s $INTERNAL_NET -o $EXT -j MASQUERADE
iptables -t nat -A PREROUTING -p tcp --dport 80 -j ACCEPT  -d
192.168.1.33
iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT
--to-port 3128

RE: Newbie Question -forcing to pass in squid

[Kevin Saenz]

I guess there are a few things I can see here, there are a number of solutions for this problem.

first you deny web access to all but one machine, through the firewall.
This will stop users from cheating by removing the proxy settings.

second, you could also install squid on your firewall and allow the users through that

-----Original Message-----
From: Flávio Brito [mailto:flavio@gral.com.br]
Sent: Monday, October 14, 2002 12:03 PM
To: netfilter@lists.netfilter.org
Subject: Newbie Question -forcing to pass in squid



Dear Friends

I have two machines, and I trying to force all port 80 traffic to pass
in SQUID 3128. But when people unset proxy in browser, they bypass SQUID
to the Internet . I cannot put transparent proxy, because SQUID is
authenticating.

Suggestions?

Thanks 

Flávio  
----------------------------------------------------------------------

FW
|-------------------------------|
|	eth0 - 200.1.2.3	|----------------------> [INTERNET]
|	eth1 - 192.168.1.1	|
|-------------------------------|
		|
		|
		SQUID
		|
|-------------------------------|
|	eth0 - 192.168.1.33	|
|-------------------------------|
		|
		|
	INTERNAL_LAN
		|
|-------------------------------|
|	192.168.1.0/24		|
|-------------------------------|


My Example


iptables -F
iptables -A INPUT -i lo -p all -j ACCEPT                    #   - Allow
self access by loopback interface
iptables -A OUTPUT -o lo -p all -j ACCEPT
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
#- Accept established connections
iptables -A FORWARD -o eth0 -j ACCEPT
iptables -t nat -A POSTROUTING -s $INTERNAL_NET -o $EXT -j MASQUERADE
iptables -t nat -A PREROUTING -p tcp --dport 80 -j ACCEPT  -d
192.168.1.33
iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT
--to-port 3128

Re: Newbie Question -forcing to pass in squid

[Antony Stone]

On Monday 14 October 2002 3:03 am, Flávio Brito wrote:

> Dear Friends
>
> I have two machines, and I trying to force all port 80 traffic to pass
> in SQUID 3128. But when people unset proxy in browser, they bypass SQUID
> to the Internet . I cannot put transparent proxy, because SQUID is
> authenticating.

I don't see why Squid Authentication stops you from setting netfilter to do 
transparent proxying.

Anyway, to solve your problem, block access from all machines except your 
Squid to external TCP port 80.

iptables -A FORWARD -s ! a.b.c.d -p tcp --dport 80 -o ethx -j DROP

where a.b.c.d is the address of the squid machine and ethx is your external 
interface.

Antony.

-- 

The difference between theory and practice is that
in theory there is no difference, whereas in practice there is.

Re: Newbie Question -forcing to pass in squid

[hare ram]

yes thats true
better u deny all going directly
deny them all who want to go directly in the rule
allow them who are going through the proxy

best of luck
hare
----- Original Message -----
From: "Kevin Saenz" <ksaenz@citistreet.com.au>
To: "Flávio Brito" <flavio@gral.com.br>; <netfilter@lists.netfilter.org>
Sent: Monday, October 14, 2002 10:16 AM
Subject: RE: Newbie Question -forcing to pass in squid


I guess there are a few things I can see here, there are a number of
solutions for this problem.

first you deny web access to all but one machine, through the firewall.
This will stop users from cheating by removing the proxy settings.

second, you could also install squid on your firewall and allow the users
through that

-----Original Message-----
From: Flávio Brito [mailto:flavio@gral.com.br]
Sent: Monday, October 14, 2002 12:03 PM
To: netfilter@lists.netfilter.org
Subject: Newbie Question -forcing to pass in squid



Dear Friends

I have two machines, and I trying to force all port 80 traffic to pass
in SQUID 3128. But when people unset proxy in browser, they bypass SQUID
to the Internet . I cannot put transparent proxy, because SQUID is
authenticating.

Suggestions?

Thanks

Flávio
----------------------------------------------------------------------

FW
|-------------------------------|
| eth0 - 200.1.2.3 |----------------------> [INTERNET]
| eth1 - 192.168.1.1 |
|-------------------------------|
|
|
SQUID
|
|-------------------------------|
| eth0 - 192.168.1.33 |
|-------------------------------|
|
|
INTERNAL_LAN
|
|-------------------------------|
| 192.168.1.0/24 |
|-------------------------------|


My Example


iptables -F
iptables -A INPUT -i lo -p all -j ACCEPT                    #   - Allow
self access by loopback interface
iptables -A OUTPUT -o lo -p all -j ACCEPT
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
#- Accept established connections
iptables -A FORWARD -o eth0 -j ACCEPT
iptables -t nat -A POSTROUTING -s $INTERNAL_NET -o $EXT -j MASQUERADE
iptables -t nat -A PREROUTING -p tcp --dport 80 -j ACCEPT  -d
192.168.1.33
iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT
--to-port 3128