LinuxQuestions.org - linux squid and iptables for secure lan for internet access.

It depends on what you are trying to do really...

I would definately say that you would use iptables because you will need to use MASQUERADE etc but whether squid is going to do anything for you i'm not sure. Squid (i could be wrong) i have found more useful is making sure machine internally are not going to innappropriate content etc.

Iptables is used to block out everything else.

try this script to block everything for outside and allow connections from inside out. You will of course need to refine this to suit your own needs.
Code:


#!/bin/sh

# Firewall V1.0



################################################################################

#                                                                              #

#                            @@@ IMPORTANT @@@                                #

#                                                                              #

# This script is to be used as a Secure Firewall. The goal when desiging this  #

# script was to prevent non-trusted traffic INTO the Leadingside Network and  #

# to Restrict access to "work related tasks". This included the developement  #

# of a Proxy server to Filter packets and block Instant Massaging.            #

#                                                                              #

# I hope that you find this script useful and that you will be able to use it  #

# in your own network environment.                                            #

#                                                                              #

# Please make sure that you read through the README file and understand what  #

# is being done by this script.                                                #

#                                                                              #

#                      Written By Chris Winfield-Blum                          #

#                                                                              #

################################################################################





# IP Forwarding

echo 1 > /proc/sys/net/ipv4/ip_forward





# Blocks External Ping requests

echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all



# Set an absolute path to IPTABLES and define the interfaces.

# OUTSIDE is the outside or untrusted interface that connects to the Internet

# and INSIDE is, well that ought to be obvious.



IPTABLES="/sbin/iptables"

OUTSIDE=eth0

INSIDE=eth1



# Other Definitions

EXT_IP="202.xxx.xxx.xx"

INT_IP="192.168.1.1"

MAILSVR="192.168.1.251"



# Test Machine Definitions

TEST_PC="192.168.1.250"

TEST_HTTP="8080"

TEST_HTTPS="8081"



# Clear out any existing firewall rules, and any chains that might have

# been created.

$IPTABLES -F

$IPTABLES -F INPUT

$IPTABLES -F OUTPUT

$IPTABLES -F FORWARD

$IPTABLES -F -t mangle

$IPTABLES -F -t nat

$IPTABLES -t nat -X

$IPTABLES -t mangle -X

$IPTABLES -X



# Set Default Rules

$IPTABLES -P INPUT DROP

$IPTABLES -P OUTPUT ACCEPT

$IPTABLES -P FORWARD ACCEPT



# Begin setting up the rulesets. First define some rule chains to handle

# exception conditions. These chains will receive packets that we aren't

# willing to pass. Limiters on logging are used so as to not to swamp the

# firewall in a DOS scenario.



# silent      - Just dop the packet

# tcpflags    - Log packets with bad flags, most likely an attack

# firewalled  - Log packets that that we refuse, possibly from an attack



$IPTABLES -N silent

$IPTABLES -A silent -j DROP



$IPTABLES -N tcpflags

$IPTABLES -A tcpflags -m limit --limit 15/minute -j LOG --log-prefix TCPflags:

$IPTABLES -A tcpflags -j DROP



$IPTABLES -N firewalled

$IPTABLES -A firewalled -m limit --limit 15/minute -j LOG --log-prefix Firewalled:

$IPTABLES -A firewalled -j DROP



# Use below to enable MASQUERADE eth1

$IPTABLES -t nat -A POSTROUTING -s 192.168.1.0/24 -j MASQUERADE



# These are all TCP flag combinations that should never, ever, occur in the

# wild. All of these are illegal combinations that are used to attack a box

# in various ways.

$IPTABLES -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j tcpflags

$IPTABLES -A INPUT -p tcp --tcp-flags ALL ALL -j tcpflags

$IPTABLES -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j tcpflags

$IPTABLES -A INPUT -p tcp --tcp-flags ALL NONE -j tcpflags

$IPTABLES -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j tcpflags

$IPTABLES -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j tcpflags



# Allow selected ICMP types and drop the rest.

$IPTABLES -A INPUT -p icmp --icmp-type 0 -j ACCEPT

$IPTABLES -A INPUT -p icmp --icmp-type 3 -j ACCEPT

$IPTABLES -A INPUT -p icmp --icmp-type 11 -j ACCEPT

$IPTABLES -A INPUT -p icmp --icmp-type 8 -m limit --limit 1/second -j ACCEPT

$IPTABLES -A INPUT -p icmp -j firewalled



# The loopback interface is inheritly trustworthy

$IPTABLES -A INPUT -i lo -j ACCEPT



# Inside Machine are trustworthy

$IPTABLES -A INPUT -i $INSIDE -d $INT_IP -j ACCEPT



# Port forwarding.



# Redirect Traffic for Port 80 to Squid Proxy Server:3128

$IPTABLES -t nat -A PREROUTING -i $INSIDE -p tcp --dport 80 -j REDIRECT --to-port 3128



# Redirect External & Internal HTTP on 8080 to Local PC

#$IPTABLES -t nat -A PREROUTING -i $OUTSIDE -p tcp -m tcp --dport $TEST_HTTP -d $EXT_IP -j DNAT --to $TEST_PC:$TEST_HTTP

#$IPTABLES -t nat -A PREROUTING -i $INSIDE -p tcp -m tcp --dport $TEST_HTTP -d $EXT_IP -j DNAT --to $TEST_PC:$TEST_HTTP



# Redirect External & Internal SSH on 8081 to Local PC

#$IPTABLES -t nat -A PREROUTING -i $OUTSIDE -p tcp -m tcp --dport $TEST_HTTPS -j DNAT --to $TEST_PC:$TEST_HTTPS

#$IPTABLES -t nat -A PREROUTING -i $INSIDE -p tcp -m tcp --dport $TEST_HTTPS -j DNAT --to $TEST_PC:$TEST_HTTPS



# Redirect External Emails to Mailserver

$IPTABLES -t nat -A PREROUTING -i $OUTSIDE -p tcp -m tcp --dport 110 -j DNAT --to $MAILSVR:110

$IPTABLES -t nat -A PREROUTING -i $OUTSIDE -p tcp -m tcp --dport 25 -j DNAT --to $MAILSVR:25



# INPUT SETTINGS



# Pop3

$IPTABLES -A INPUT -i $OUTSIDE -d 0/0 -p tcp -m tcp --dport 110 -j ACCEPT

# SMTP

$IPTABLES -A INPUT -i $OUTSIDE -d 0/0 -p tcp -m tcp --dport 25 -j ACCEPT

# SSH

#$IPTABLES -A INPUT -i $OUTSIDE -d 0/0 -p tcp --dport 22 -j ACCEPT

# HTTP

#$IPTABLES -A INPUT -i $OUTSIDE -d 0/0 -p tcp -m tcp --dport 80 -j ACCEPT

# HTTPS

#$IPTABLES -A INPUT -i $OUTSIDE -d 0/0 -p tcp -m tcp --dport 443 -j ACCEPT

# TEST PC

#$IPTABLES -A INPUT -i $OUTSIDE -p tcp -m tcp --dport $TEST_HTTP -j ACCEPT

#$IPTABLES -A INPUT -i $OUTSIDE -p tcp -m tcp --dport $TEST_HTTPS -j ACCEPT



# Allow packets that are part of an established connection to pass

# through the firewall. This is required for normal Internet activity

# by inside clients.

$IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT



# Anything that hasn't already matched gets logged and then dropped.

$IPTABLES -A INPUT -j firewalled