adding firewalls nat rules

divyashree · 10-04-2010, 05:56 AM

I have a centos5.3 server. I want to configure it as transparent squid proxy server. Internet is connected to eth0(192.168.0.100) and lan is connected to eth1(192.168.200.0/24) and eth1 ip is 192.168.200.1 .

I have configured it as dhcp,squid and its working fine.

Now I want to configure it as a transparent,so that no one has to manually configure in browser.

I just added a line

Code:

http_port 3128 transparent

to make it transparent.

Now while adding nat rules,

Quote:

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128

Quote:

iptables -A INPUT -j ACCEPT -m state --state NEW,ESTABLISHED,RELATED -i eth1 -p tcp --dport 3128

Quote:

iptables -A OUTPUT -j ACCEPT -m state --state NEW,ESTABLISHED,RELATED -o eth0 -p tcp --dport 80

Quote:

iptables -A INPUT -j ACCEPT -m state --state ESTABLISHED,RELATED -i eth0 -p tcp --sport 80

Quote:

iptables -A OUTPUT -j ACCEPT -m state --state ESTABLISHED,RELATED -o eth1 -p tcp --sport 80

Code:

iptables -t nat -A PREROUTING -i eth1 -s ! 192.168.200.1  -p tcp --dport 80 -j DNAT --to 192.168.200.1:3128

Code:

iptables -t nat -A POSTROUTING -o eth1 -s 192.168.200.0/24  -d 192.168.200.1 -j SNAT --to 192.168.200.1

Code:

iptables -A FORWARD -s 192.168.200.0/24 -d 192.168.200.1 -i eth1 -o eth1 -m state  --state NEW,ESTABLISHED,RELATED  -p tcp --dport 3128 -j ACCEPT

Code:

iptables -A FORWARD -d 192.168.200.0/24 -s 192.168.200.1 -i eth1 -o eth1 -m state --state ESTABLISHED,RELATED -p tcp --sport 3128 -j ACCEPT

Internet is totally blocked on eth1.

And after stopping the firewall the internet comes.

prayag_pjs · 10-04-2010, 06:11 AM

Hi,

Hope this helps you

# squid server IP
SQUID_SERVER="192.168.1.1"
# Interface connected to Internet
INTERNET="eth0"
# Interface connected to LAN
LAN_IN="eth1"
# Squid port
SQUID_PORT="3128"

# DNAT port 80 request comming from LAN systems to squid 3128 ($SQUID_PORT) aka transparent proxy
iptables -t nat -A PREROUTING -i $LAN_IN -p tcp --dport 80 -j DNAT --to $SQUID_SERVER:$SQUID_PORT
# if it is same system
iptables -t nat -A PREROUTING -i $INTERNET -p tcp --dport 80 -j REDIRECT --to-port $SQUID_PORT

sem007 · 10-04-2010, 06:15 AM

Add redirect rule and check.

Code:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128

Regards,

divyashree · 10-04-2010, 06:44 AM

Now packets are coming to 192.168.0.100 but without specifying the port(3128) and IP(192.168.200.1) in Client systems , no packet is coming.

prayag_pjs · 10-04-2010, 06:45 AM

Didn't get, what are you trying to say?

divyashree · 10-04-2010, 07:10 AM

Quote:

Originally Posted by prayag_pjs

Didn't get, what are you trying to say?

I am trying to say, I am adding port and ip in client's browser then only internet packets comes to client which can be amde without adding any rules to iptables.

I want the packets come to client machine without mentioning the port(3128) and ip(192.168.200.1) in the client's browser.

sem007 · 10-04-2010, 07:16 AM

Hi divyashree,

Take look

Setup a transparent proxy with Squid in three easy steps

Regards,

divyashree · 10-04-2010, 07:40 AM

Quote:

Originally Posted by sem007

Hi divyashree,

Take look

Setup a transparent proxy with Squid in three easy steps

Regards,

I have already checked this and its not working at all.

sem007 · 10-04-2010, 07:56 AM

what is your client's default gateway ?

also post squid config and iptables

Code:

# grep -v "^#" /etc/squid/squid.conf | sed -e '/^$/d'
# iptables -t nat -L

Regards,

divyashree · 10-04-2010, 08:04 AM

Quote:

Originally Posted by sem007

what is your client's default gateway ?

also post squid config and iptables

Code:

# grep -v "^#" /etc/squid/squid.conf | sed -e '/^$/d'
# iptables -t nat -L

Regards,

1st

Code:

acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
acl localnet src 10.0.0.0/8     # RFC1918 possible internal network
acl localnet src 172.16.0.0/12  # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl localnet src fc00::/7       # RFC 4193 local private network range
acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines
acl viznet src 192.168.10.0/24
acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager
http_access allow viznet
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localnet
http_access allow localhost
http_access deny all
http_port 3128
http_port 3128 transparent
hierarchy_stoplist cgi-bin ?
coredump_dir /var/spool/squid
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern .               0       20%     4320

2nd

Code:

target     prot opt source               destination         

DNAT       tcp  --  anywhere             anywhere            tcp dpt:http to:192.168.0.100:3128 
REDIRECT   tcp  --  anywhere             anywhere            tcp dpt:http redir ports 3128 

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

kaushalpatel1982 · 10-04-2010, 08:06 AM

Are you able to ping any server( ping google.com) from your client?

divyashree · 10-04-2010, 08:09 AM

Quote:

Originally Posted by kaushalpatel1982

Are you able to ping any server( ping google.com) from your client?

No ,

sem007 · 10-04-2010, 08:13 AM

where is acl rule and http_access rule for 192.168.200.0 network?

Quote:

acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl localnet src fc00::/7 # RFC 4193 local private network range
acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines

Why you create multiple acl with same name?

Regards,

divyashree · 10-04-2010, 08:43 AM

Quote:

Originally Posted by sem007

where is acl rule and http_access rule for 192.168.200.0 network?

Why you create multiple acl with same name?

Regards,

Sorry that was the output of another linux box.

Quote:

acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl localnet src fc00::/7 # RFC 4193 local private network range
acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines

acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager

acl mylan src 192.168.200.0/24
http_access allow mylan

http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localnet
http_access allow localhost
http_access deny all
http_port 3128
http_port 3128 transparent
hierarchy_stoplist cgi-bin ?
coredump_dir /var/spool/squid
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320

And I am using squid version 3 in which the entries are by default.

sem007 · 10-04-2010, 09:29 AM

add both ip in acl rule in squid.conf

Code:

acl mylan src 192.168.0.100 192.168.200.0/24

enable ip forwarding.

Code:

# echo 1 > /proc/sys/net/ipv4/ip_forward
# vim /etc/sysctl.conf
net.ipv4.ip_forward = 1

flush existing firewall and apply new rules.

Code:

#iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
#iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
#iptables -A FORWARD -i eth1 -j ACCEPT
#iptables -A INPUT -i eth1 -j ACCEPT
#iptables -A OUTPUT -o eth1 -j ACCEPT
#iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to 192.168.0.100:3128
#iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128

Regards,