Direct Internet Connection For Client

Direct Internet Connection For Client

[Tarak Ranjan]

Hi list,
           i have installed proxy and gateway in the same system. How 
can  stop "Direct Connection" in web browser for internet for the 
clients(proxy). i have redirect 80 port to 8080. then also direct 
connection is happening from the clients. what sort of iptables rules 
i've to implement in my gateway firewall , that every time users should 
pass through proxy(8080). No Direct Connection........



-- 
Thanks & Regards,
______________
Tarak Ranjan
E: tarak.ranjan@liqwidkrystal.com
IM: reachtarak@hotmail.com

Online Learning|Certification|Learning Solutions :
www.liqwidkrystal.com

Re: Direct Internet Connection For Client

[Покотиленко Костик]

В Вто, 13/11/2007 в 12:59 +0530, Tarak Ranjan пишет:
> Hi list,
>            i have installed proxy and gateway in the same system. How 
> can  stop "Direct Connection" in web browser for internet for the 
> clients(proxy). i have redirect 80 port to 8080. then also direct 
> connection is happening from the clients. what sort of iptables rules 
> i've to implement in my gateway firewall , that every time users should 
> pass through proxy(8080). No Direct Connection........

iptables -A FORWARD -i <client_iface> -o <inet_iface> -j REJECT
--reject-with icmp-admin-prohibited

-- 
Покотиленко Костик <casper@meteor.dp.ua>

RE: Direct Internet Connection For Client

[Rob Sterenborg]

> Hi list,
>            i have installed proxy and gateway in the same system.
> How
> can  stop "Direct Connection" in web browser for internet for the
> clients(proxy). i have redirect 80 port to 8080. then also direct
> connection is happening from the clients. what sort of iptables
> rules
> i've to implement in my gateway firewall , that every time users
> should
> pass through proxy(8080). No Direct Connection........

When your clients can still connect when you redirect port 80 to 8080
then your redirection doesn't work.
This may be because packets hit another rule before the redirection. Or
maybe you are redirecting to localhost which, (last time I tried) is not
possible.

If I'm correct you've posted this question before and when I looked
through that script I didn't have much trust in it. If you really want
good advice, post your ruleset (and perhaps routing table). Otherwise,
simply blocking internet access is done like this:

$ipt -A FORWARD -s <net_lan> -p tcp --dport 80 \
  -j REJECT --reject-with tcp-reset

The actual place where you want to insert the rule depends on the script
you're currently using. This will do nothing if packets are already
accepted by a previous rule.


Grts,
Rob

Re: Direct Internet Connection For Client

[Tarak Ranjan]

[-- Attachment #1: Type: text/plain, Size: 624 bytes --]



Rob Sterenborg wrote:
>> 
> If I'm correct you've posted this question before and when I looked
> through that script I didn't have much trust in it. If you really want
> good advice, post your ruleset (and perhaps routing table). Otherwise,
> simply blocking internet access is done like this:
> 
> $ipt -A FORWARD -s <net_lan> -p tcp --dport 80 \
>   -j REJECT --reject-with tcp-reset
> 
> The actual place where you want to insert the rule depends on the script
> you're currently using. This will do nothing if packets are already
> accepted by a previous rule.
> 


Here is my iptables rules........ as an attachment

[-- Attachment #2: custom_rules.sh --]
[-- Type: application/x-shellscript, Size: 9850 bytes --]