Networking :: SQUID Intercept IPtables - Whitelisting Ports And Sites

Jul 6, 2011

I'm having some issues settings up a transparent proxy server, which should allow only regular web browsing (port 80), any other port (including HTTPS (443)) has to be blocked, as well as any other port. Right now, I'm using Debian 6 and Squid3. The server only has one NIC. The topology is like this:
Clients <-> Proxy Server + DHCP Server <-> Internet

With this setup, the network does have internet access and the websites I whitelisted are the only ones accesible via browser, however port block is not working, every port is open, hence why trying to access blacklisted websites through HTTPS is possible. Seems to me Squid3 is doing it's job fine, however IPTABLES for some reason seems to be redirecting all the trafic to port 3128 (Squid3 port). I could be wrong, but I've been unable to do anything related to ports with squid3 (either whitelisting or blacklisting).

For Iptables I used:
Code:
iptables -A PREROUTING -t nat -i eth0 -p tcp -j REDIRECT --dport 80 --to-port 3128
iptables -A INPUT -i eth0 -m tcp -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -i eth0 -m tcp -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -i eth0 -m tcp -p tcp --dport 3128 -j ACCEPT
iptables -A INPUT -i eth0 -m tcp -p tcp --dport 443 -j DROP

Squid3 config:
Code:
acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
acl Safe_ports port 80 # http
acl whitelist dstdomain "/etc/squid3/whitelist"
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny !whitelist
http_access allow localhost
http_access allow all
http_port 3128 intercept
hierarchy_stoplist cgi-bin

View 2 Replies


ADVERTISEMENT

Networking :: Squid ACL For NAT And VoIP Sites

Jul 16, 2011

I just setup a linux machine that act as a gateway along with squid running in transparent mode. Now I have one asterisk server which is behind that gateway I mean on my local subnet which pass through my linux gateway. Voip server having 4mb up n 4 mb down limit. Clients having 512kbps and upload 2mb.

Linux gateway : controlling band width of each clients
Squid acl forNAT issue with voip sites

Now my question is regarding skype calling. Since skype uses port 80, does it mean that it passes its request via proxy or direct and for safe side I've changed skype incoming port to 443 which squid does not see it. How much and width does skype use for calling in that case. Some one told me that it using squid to pass its request which I don't agree.

View 2 Replies View Related

Networking :: Blocking Sites With SQUID Proxy?

Feb 17, 2010

I need to block some of my sites with SQUID Proxy. I added following lines to my SQUID configuration file but still the site remains unblocked.How to block it?

acl blocksites url_regex yahoo http_access deny blocksites

I have also tried saving some url & filter content in a file and edited configuration as follows,

acl blocksites url_regex "/etc/squid/squid-block.acl" http_access deny blocksites

The squid-block.acl file contents are, .cricinfo.com mp3

View 4 Replies View Related

Ubuntu Networking :: Blocking Sites With SQUID Proxy?

Feb 17, 2010

I need to block some of my sites with SQUID Proxy. I added following lines to my SQUID configuration file but still the site remains unblocked.How to block it?acl blocksites url_regex yahoohttp_access deny blocksitesI have also tried saving some url & filter content in a file and edited configuration as follows,acl blocksites url_regex "/etc/squid/squid-block.acl"http_access deny blocksitesThe squid-block.acl file contents are.cricinfo.commp3

View 2 Replies View Related

Networking :: Cant Open Any Ports In Iptables?

May 14, 2009

Since there was no response on my other post which i spent about a hour writing, ill go for something simpler. I run this on my server

Code:
# set default policy for the NAT table
iptables -t nat -P PREROUTING ACCEPT

[code]...

View 9 Replies View Related

Networking :: Forwarding Ports With Iptables?

Dec 23, 2010

I am running a server with ssh and a vpn server set up. It is behind a debian router with a firewall which uses iptables. i have it set up to forward ports 22 and 443 to ssh on a computer within the LAN(so when on a restricted network i can still ssh into my network) and forward anything to 1723(for my vpn) to that box also. However, the only port that gets successfully forwarded is port 22. The other two appear closed. here is what the script looks like:

Code:
#!/bin/sh
#

[code]...

View 2 Replies View Related

Fedora Networking :: Iptables On Bridge Ports?

Apr 21, 2011

I'd like to pass all traffic between bridge ports via the FORWARDING chain, so I changed following sysctl parameters:

Code:
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1

[code]...

View 1 Replies View Related

Networking :: Set Any Ports On Iptables For One Specific Host Only?

Feb 16, 2011

I like to set in iptables to allow access from one host to my server on any ports.

Currently the iptables have been configured to deny all and to allow access only to those I've specified.

Can anyone advice on the command to achieve this?

View 1 Replies View Related

Networking :: Iptables - Portforward To External IP And Ports?

Jun 30, 2011

I want to portforward client connections from an ubuntu lts server to another external server. btw i am a noob on iptables. i have tryed using the basic commands for iptables with no success. For example:iptables -A PREROUTING -t nat -i eth1 -p tcp --dport 7878 -j DNAT --to 91.23.45.67:7878iptables -A FORWARD -p tcp -i eth1 -o eth0 -d 91.23.45.67 --dport 7878 -j ACCEPTso basically i just want a rediraction for from one ip to another. Example: A client tries to connect to ip 123.45.67.89 on port 7878 and the server forwards him to ip xx.xx.xx.xx on port 7878, meaning that xx.xx.xx.xx is the actual server with services. Server with ip 123.45.67.89 is only forwarding the client to external ip... how can this be done in a simple command?

View 7 Replies View Related

Ubuntu Networking :: Set Any Ports On Iptables For One Specific Host Only?

Feb 15, 2011

I like to set in iptables to allow access from one host to my server on any ports.Currently the iptables have been configured to deny all and to allow access only to those I've specified.

View 2 Replies View Related

Networking :: Configuring Iptables To Locally Translate Some Ports?

Apr 27, 2011

Because my ISP is blocking every IP port under 1000, I'd like my local nat'ed server to be able to translate incoming and outgoing traffic from some port above 1000 to the default server port locally.Example :

To connect to my IMAP server (default port : 143) from the outside,I'd connect to my public IP, port 1143 (opened and nat'ed to the right server on my router) and the server would translate this port to 143 on the same machine.I wish I could simply configure my router to do that but sadly Linksys doesn't permit such setting... I also could modify the listening port of my server but I prefear to keep the default port inside my network.I think that iptables is the right tool to do that and I never used it and I must say that this tool is not so easy to configure at first sigh

View 5 Replies View Related

Networking :: Block IM With Iptables Or Squid?

Dec 24, 2008

in my office i have to block all messenger like yahoo messenger, windows live messenger, i have to block websites like www.yahoo.com, some more web sites. i need guidance through which i can accomplish this task through ip tables or through squid server. i can use squid but i had heard that squid blocks pop and smtp also. squid creates some problem in receiving and sending email. i am using red hat linux 4 box and installed squid having two ethernet card 1 is connected to adsl line and 2 is connected to switch. all clients will have proxy address of this linux box. guys need ur help ASAP.

View 2 Replies View Related

Networking :: Https Blocked By Squid / Iptables

Nov 29, 2010

I connect to the internet at work through an authenticating proxy, and to avoid having to enter the proxy info into every app I use (e.g. firefox, wget, kde, etc) I have set up squid as a local transparent proxy which authenticates and routes all traffic to the work proxy. It has been working fine, but lately I haven't been able to connect to any https sites. I don't think I have changed the configuration, so perhaps it is the result of an upgrade, or something badly configured on my system from the start. I have tried connecting to https sites without squid and iptables and it works fine. My system is Arch linux, and my squid.conf file is: Code:

acl all src all
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443
acl Safe_ports port 80# http
acl Safe_ports port 21# ftp
acl Safe_ports port 443# https
[Code]....

View 2 Replies View Related

Networking :: Iptables - Set Up Ip Table And A Transparent Squid Proxy

Nov 10, 2010

I need to set up an ip table and a transparent squid proxy as followed: I have 3 machine: Machine 1 works as a squid proxy. It has 2 interface eth1 and eth2.

eth1: 192.168.99.2 (Connect to eth1 of machine 2)
eth2: 192.168.98.2 (Connect to eth1 of machine 3)

machine 2 works as a webserver
eth1: 192.168.99.4
machine 3 works as a web client.
eth1: 192.168.98.4

my responsibility is to send all tcp traffic from machine 3 at port 80 to my squid proxy. In order to fulfill the tasks, I have edited the squid.conf as followed: Code: http_access allow localnet http_access allow localhost and in machine 1, I tried 2 ip tables command: Code: iptables -t nat -A PREROUTING -i eth2 -p tcp --dport 80 -j DNAT --to 192.168.99.2:80 iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 80 I don't know if it is right or wrong.

View 7 Replies View Related

Networking :: Whitelisting Specific Domain For RDNS?

Feb 21, 2010

I use the DynDNS service to keep track of my home server IP. The problem here is that when I try to access my web server via my domain name, the connection is refused. If I first obtain the ip adress (via nslookup), I can get access. I checked the reverse dns lookup and the results dont match. Perhaps this can be a problem browsing. Does the browser or the OS perform the rdns check? Is there a way to whitelist some specific domain in order to skip that check, so I dont have to find out the IP address every time i want to access my home server.

View 1 Replies View Related

Networking :: Logging Skype Data Usage In Squid / Iptables

Feb 3, 2010

I've set up a transparrent squid box with two nics. Eth1 = Internet eth0= LAN +Dchp my question is, can I log the data usage of a skype call. My proxy server already records all http an https requests but doesn't record some programs like skype. I know that it is not http traffic, but can I tell my system to record data use by an ip address over a nic with the help of iptables for example?

View 1 Replies View Related

Networking :: Squid And IPTABLES - Transparent Proxy Doesn't Work

Jan 12, 2011

I setup squid with transparent proxy and its working, however, when I reboot the server, the proxy server doesnt work unless I run the following.

Code: # squid server IP
SQUID_SERVER="192.168.1.1"
# Interface connected to Internet
INTERNET="eth0"
# Interface connected to LAN
LAN_IN="eth1"
# Squid port
SQUID_PORT="3128"
[Code]...

View 6 Replies View Related

Networking :: Iptables + Squid + Dansguardian - Boxes Will Act As A INTERNET Firewall + Filtering?

Jan 14, 2011

is this possible on 2 Linux boxes will act as a INTERNET Firewall + Filtering: 1st PC = CENTOS 5.5 functions as a firewall using iptables with two NICS 1=ETH0 connected to internet with a public ip and 1=ETH1 with ip address of 10.0.0.1 connected to the 2nd PC Centos 5.5 with squid/dansguardian with ip address of 10.0.0.2

2nd PC = Centos 5.5 functions as a squid + dansguardian internet filtering with 2 NICS 1=ETH0 with ip address of 10.0.0.2 connected to the ETH1 of the 1st PC with ip address of 10.0.0.1 and 2nd ETH1=connected to LAN (172.16.1.0/24)

does this make sense? this might be confusing but I just want to try this, to protect incoming ssh from our previous Sys admins who intended to enter the LAN 172.16.1.0/24 network. And also to confuse them that they have to pass through 10.0.0.1 - 2.

View 3 Replies View Related

Networking :: Squid With Iptables - Make Clients To Browse Internet Only From Proxy Server?

Jun 14, 2010

i have the following ip assignments

fedora (iptables)
eth0 -private :192.168.1.1
eth1 -public : 186.117.50.6
squid proxy
192.168.1.10:3128
my clients range
192.168.2.0/24

how can i make my clients to browse internet only from proxy server my network is NAT 'ed. Please specify a iptable rule to allow internet access for my clients to browse ONLY if they come through proxy server.

View 1 Replies View Related

Ubuntu :: Webmin/Squid - Allows Only Certain Sites?

Aug 9, 2010

Using 10.4, got the webmin installed and squid. Got my access control list setup.Within the acccess control list setup, I can not go to sites likemethodistmd.org or mollimd.org for whatever reason. But I can go to votekirkland as well as google. Why would webmin and/or squid only work with certain sites within the the defined access control list?

View 9 Replies View Related

Security :: Squid - Block Different Users Different Sites?

Feb 6, 2010

Example I have 3 user list and 3 file with block site names

acl group1 src 192.168.0.2 192.168.0.3 192.168.0.4/24
acl group2 src 192.168.0.5 192.168.0.6 192.168.0.7/24
acl group3 src 192.168.0.8 192.168.0.9 192.168.0.10/24

[Code]...

I've moved your post here to its own thread. Please don't resurrect dead threads. --win32sux

View 1 Replies View Related

Server :: Allow Only Two Web Sites Access By Squid Proxy?

May 19, 2010

i just implemented ur instruction n got success but i have one problem that i want to provide only two or three web sites access to groups in squid.

View 1 Replies View Related

Security :: Squid Proxy Block Sites Or Domain

Apr 5, 2010

I have a problem with sites or domain blocking by squid proxy server in rehl 5. I have trying lots of time but i'm not succed.pls help me how to block sites or domain in rhel 5.

View 3 Replies View Related

Server :: Restrict Web Accessing To Different Groups For Different Sites In Squid 2.6?

May 19, 2010

i have seven department in my office. i want to restricte web sites for all the departments but not same web sites for all the departments i.e. different sites for different departments.i have no idea about this issue.

View 1 Replies View Related

Ubuntu Servers :: Squid Configuration, Allow Blocked Sites Only For 2 Users

Jan 18, 2011

My Squid is working. But I do not know how to unblock a proxy for two users on my network. My configuration

Code:
acl work src 192.168.16.0/24
acl sites dstdomain "/etc/squid/sites.acl"
acl files urlpath_regex "/etc/squid/files.acl"
acl boss src 192.168.16.12

[Code]....

How to enable blocked sites and files for boss and it_user?

View 2 Replies View Related

Security :: Configure Squid Server To Block Anon Proxy Sites?

Jul 22, 2010

I have setup a squid server on Rhel5.4. I would like to know how I can configure my squid server to block anon proxy sites.

View 3 Replies View Related

Security :: Anyway To NOT Log Dropped Ports 137 / 138 In Iptables?

Mar 30, 2011

We do NOT support samba on our Unbuntu servers but still zillions of windows machines are constantly trying to connect on the SMB ports. I've added a rule that drops access to destination ports 137-138 and that seems to work. But it creates many many log entries documenting that the packet has been dropped. I've been researching and cannot come up with a way to suppress logging for these drops.

View 4 Replies View Related

Software :: Configure IPTABLES To Allow Certain IP Ranges To Ports 25 And 465?

Feb 16, 2011

I have a mail server with IPTABLES enabled.I want to allow access to:

41.0.0.0/8
58.0.0.0/8
61.0.0.0/8

[code]....

View 7 Replies View Related

Software :: Open Ports Using Iptables From Shell?

Sep 18, 2009

I am trying to open VNC ports(5901,5902) on my RHLinux machine using iptables. I am able to do it from GUI system-config-security. Go to the Administration > Security Level and Firewall, then select "other ports" at the bottom and enter the portNum 5901 to open and select tcp, then click OK and OK again to save your settings. From my windows m/n iam able to open vncsession using vncviewer on 5901 port.But when I am trying to do it from command line:#iptables -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 5901 -j ACCEPTThis command added the entry in /etc/sysconfig/iptables and listed in iptables -L command.Then I saved and restarted the iptables.#service iptables save
#service iptables restartWhen I am trying to open the VNC session from vncviewer, it is giving me error and session not opened.Is there some thing I missed here? where can I check the logs for this? I definetly need

View 3 Replies View Related

OpenSUSE Network :: Block All Ports But Port 80 With Iptables (DMZ)?

Jun 25, 2010

I have a Suse 10.3 router with 4 network cards. 1 is to connect to the big network and thereby also the internet, 2 are for 'client' subnets and I want to use the last one as a DMZ. In this DMZ will be a web server which has to be accessible from the other 2 subnets and from the big network. I could do it with a few simple clicks in Yast firewall, but I have some issues with this firewall and there for I want to use it as minimal as possible, using Iptables.

So now I'm struggling a bit with Iptables. Basicly what I'm looking for is how to block all ports but 80 in this last subnet with iptables.

View 5 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved