LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 11-01-2005, 08:30 AM   #1
alcor
LQ Newbie
 
Registered: Nov 2005
Posts: 2

Rep: Reputation: 0
iptables+squid


Well ... I read about iptables+squid to block msn+yahoo+radios .... I can do it with iptables with 2 rules:
/sbin/iptables -A INPUT -p TCP -s $filter -j DROP
/sbin/iptables -A INPUT -p UDP -s $filter -j DROP

where $filter is a list of servers to block.

With this I found that iptables doesnt block some domains ....

I try with squid doing :

acl intra src 192.168.1.0/255.255.255.0
acl msn req_mime_type ^application/x-msn-messenger
acl MSN-MESSENGER dst "sfilterip"
acl msnd dstdomain .webmessenger.msn.com
acl msnd dstdomain *.iloveim.com
acl listamsn dstdomain "/etc/squid/sfilter"
acl yahoo dstdomain pager.yahoo.com
acl yahoo dstdomain shttp.msg.yahoo.com
acl yahoo dstdomain update.messenger.yahoo.com
acl yahoo dstdomain update.pager.yahoo.com

http_access deny intra msn
http_access allow intra
http_access deny intra MSN-MESSENGER
http_access deny msnd
http_access deny intra listamsn
http_access allow localhost
http_access deny yahoo
http_access allow all

And nothing ...

so ... I want to see if I can block it but not block to me

any advice ?
 
Old 11-02-2005, 05:13 PM   #2
peter_robb
Senior Member
 
Registered: Feb 2002
Location: Szczecin, Poland
Distribution: Gentoo, Debian
Posts: 2,458

Rep: Reputation: 48
Depending on your setup, if your proxy is transparent, you will need some DNAT or REDIRECT rules to force traffic into the proxy.
Packets going from clients will have an external ip destination address in them.
Rules will need to be interface specific and specify checking the destination address.. eg
-A INPUT -i eth0 -p tcp -d $filter -j DROP

For clients that are set to use the proxy on say port 8080, they will have a local address as a destination address, so squid will have to send to the external ip address.
You can filter in the OUTPUT chain as above..
-A OUTPUT -o eth1 -p tcp -d $filter -j DROP

I can't comment on the squid rules coz I use Dansguardian to do url/content filtering..
www.dansguardian.org

Last edited by peter_robb; 11-02-2005 at 05:17 PM.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
squid management with IPtables shamza Linux - Networking 1 07-08-2005 03:13 PM
squid + iptables varun_saa Mandriva 10 02-11-2005 09:27 PM
squid and iptables masquerading egyptian Linux - Security 1 09-05-2004 04:31 AM
iptables and squid batfink Linux - Networking 3 09-15-2003 02:51 PM
Iptables / Squid Configuration aushtosh Linux - Security 2 04-09-2002 11:57 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 07:05 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration