LinuxQuestions.org
Register a domain and help support LQ
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 01-16-2013, 02:16 AM   #1
sandeepc04
Member
 
Registered: Jun 2012
Location: India
Posts: 66

Rep: Reputation: Disabled
Squid Server with Global IP... 8.8.8.8


Hi Friends,

Today i am facing some issue with 8.8.8.8 DNS...

I have blocked all unwanted websites in squid (Linux Server is running on RHEL5) in same server DHCP is running... Now all windows clients are getting IP + Internet from same server (Squid + DHCP)...

ISSUE...

Now what problem is going on means, some xp clients are using 8.8.8.8 DNS and opening unwanted (blocked sites)... I have tried with blocking 8.8.8.8 IP in squid... but when client gives 8.8.8.8 as DNS that client machine is not reflecting to squid... if i stop squid then also they are able to access internet... how to stop this? is there any way that i can block this DNS ?

Please help on this ASAP...

Regards,
Sandeep CC
 
Old 01-16-2013, 03:08 AM   #2
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974
Why would blocking a single DNS server make any difference whatsoever? What if they then use 4.4.8.8?

you should simply not be permitting outbound internet access from any device that is not your proxy. Put a firewall between your users and the internet and it's painfully simple then.
 
Old 10-16-2013, 03:05 AM   #3
sandeepc04
Member
 
Registered: Jun 2012
Location: India
Posts: 66

Original Poster
Rep: Reputation: Disabled
Becoming big issue in squid server

Hi Sorry for late reply,

This issue is raising like big problem for me at office...

same squid server i have configured as DNS server also for ping resolve issue... now if xp clients keep my local squid/dns server IP or any 8.8.8.8/4.2.2.2 etc... as DNS then they are removing proxy setup from client IE and using internet... That time i am not finding that particular machine logs in /var/log/squid/access file.... That means if client remove IE setting proxy then client is getting direct Internet from my router (Shorewall configured on RHEL)...

Can you tell me what firewall/iptables i can make setup?

Thanks and Regards,
Sandeep CC
 
Old 10-16-2013, 03:42 AM   #4
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974
you would need to just stop shorewall allowing any outbound traffic from any machine that isn't the proxy or other authorised sources. That's presuming that this shorewall instance it physically in between your clients and the internet connection.
 
Old 10-16-2013, 03:45 AM   #5
GNU/Linux
Member
 
Registered: Sep 2012
Distribution: Slackware-14
Posts: 118

Rep: Reputation: Disabled
I'm no expert but you should block all direct access to the Internet (or outside world) except from your proxy server. All traffic should be redirected through your proxy server to the Internet.

Quote:
That means if client remove IE setting proxy then client is getting direct Internet from my router (Shorewall configured on RHEL)...
As 'acid_kewpie' suggested, on the router that connects you to the outside world you should only allow your proxy server to access it, and not any of your clients (XP machines or what not).
 
Old 10-16-2013, 04:48 AM   #6
sandeepc04
Member
 
Registered: Jun 2012
Location: India
Posts: 66

Original Poster
Rep: Reputation: Disabled
Thanks for your reply,

I am not understanding where exactly i am doing mistake... Below i am putting my rules file...

I have opened required port in rules file... please check my file and let me know where i am doing wrong

-------------------------------------------------------------------

cat /etc/shorewall/rules
#
# Shorewall version 4 - Rules File
#
# For information on the settings in this file, type "man shorewall-rules"
#
# The manpage is also online at
# http://www.shorewall.net/manpages/shorewall-rules.html
#
#################################################################################################### ################################################
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME
# PORT PORT(S) DEST LIMIT GROUP
#
# Accept DNS connections from the firewall to the Internet
#
ACCEPT fw net tcp 53
ACCEPT fw net udp 53
#
#
# Accept SSH connections from the local network to the firewall and DMZ
#
ACCEPT loc fw tcp 22
ACCEPT loc dmz tcp 22
#
# DMZ DNS access to the Internet
#
ACCEPT dmz net tcp 53
ACCEPT dmz net udp 53

ACCEPT loc net tcp 53
ACCEPT loc net udp 53

ACCEPT loc fw tcp 53
ACCEPT loc fw udp 53

ACCEPT dmz fw tcp 53
ACCEPT dmz fw udp 53

ACCEPT loc net udp 123
ACCEPT loc fw udp 4242 # Ntop
#
# Make ping work bi-directionally between the dmz, net, Firewall and local zone
# (assumes that the loc-> net policy is ACCEPT).
#
ACCEPT net fw icmp 8
ACCEPT loc fw icmp 8
ACCEPT dmz fw icmp 8
ACCEPT loc dmz icmp 8
#
#ACCEPT vpn dmz icmp 8
#ACCEPT dmz vpn icmp 8
#
ACCEPT dmz loc icmp 8
ACCEPT dmz net icmp 8
ACCEPT fw net icmp 8
ACCEPT fw loc icmp 8
ACCEPT fw dmz icmp 8
ACCEPT net dmz icmp 8 # Only with Proxy ARP and
ACCEPT net loc icmp 8 # static NAT
ACCEPT loc net icmp 8

# additional rules by Sandeep CC(Office: Sept 04, 2013)
ACCEPT loc net tcp
#
# DMZ to net access rules
#
ACCEPT loc fw tcp
#
# remote Desktop
ACCEPT fw net tcp 3389
ACCEPT net loc tcp 3389
ACCEPT net dmz tcp 3389
ACCEPT loc dmz tcp 3389
ACCEPT dmz loc tcp 3389

#FTP
ACCEPT net fw tcp 21
ACCEPT net fw udp 21
ACCEPT net fw tcp 20
ACCEPT net fw udp 20
ACCEPT net loc tcp 21
ACCEPT net loc udp 21
ACCEPT net loc tcp 20
ACCEPT net loc udp 20
##Office FTP
ACCEPT net fw tcp 1021
ACCEPT net fw udp 1021
ACCEPT net loc tcp 1021
ACCEPT net loc udp 1021
##http allow
ACCEPT net fw tcp 80
ACCEPT net fw udp 80
ACCEPT net loc tcp 80
ACCEPT net loc udp 80
ACCEPT loc net tcp 80
ACCEPT loc net udp 80
ACCEPT all dmz tcp 80
##Office http
ACCEPT net fw tcp 81
ACCEPT net fw udp 81
ACCEPT net loc tcp 81
ACCEPT net loc udp 81
##Office http
ACCEPT net fw tcp 82
ACCEPT net fw udp 82
ACCEPT net loc tcp 82
ACCEPT net loc udp 82
##Office http
ACCEPT net fw tcp 85
ACCEPT net fw udp 85
ACCEPT net loc tcp 85
ACCEPT net loc udp 85
##Office eduproxy1
##http allow
ACCEPT net fw tcp 9542
ACCEPT net fw udp 9542
ACCEPT net loc tcp 9542
ACCEPT net loc udp 9542
##POP3
ACCEPT net fw tcp 100
ACCEPT net fw udp 110
ACCEPT net loc tcp 110
ACCEPT net loc udp 110
##SMTP
ACCEPT net fw tcp 25
ACCEPT net fw udp 25
ACCEPT net loc tcp 25
ACCEPT net loc udp 25
##HHTPS POP
ACCEPT net fw tcp 587
ACCEPT net fw udp 587
ACCEPT net loc tcp 587
ACCEPT net loc udp 587
##HHTPS SMTP
ACCEPT net fw tcp 995
ACCEPT net fw udp 995
ACCEPT net loc tcp 995
ACCEPT net loc udp 995
##HHTPS SMTP
ACCEPT net fw tcp 465
ACCEPT net fw udp 465
ACCEPT net loc tcp 465
ACCEPT net loc udp 465
##HHTPS SMTP
ACCEPT net fw tcp 443
ACCEPT net fw udp 443
ACCEPT net loc tcp 443
ACCEPT net loc udp 443
##FTP
ACCEPT net fw tcp 20
ACCEPT net fw udp 20
ACCEPT net loc tcp 20
ACCEPT net loc udp 20
ACCEPT net fw tcp 21
ACCEPT net fw udp 21
ACCEPT net loc tcp 21
ACCEPT net loc udp 21
#SECTION ESTABLISHED
#SECTION RELATED
#SECTION NEW


Regards,
Sandeep CC

Last edited by sandeepc04; 10-16-2013 at 04:50 AM.
 
Old 10-16-2013, 04:54 AM   #7
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974
it's not about opening ports, it's about closing the closing them

Code:
##http allow
ACCEPT net fw tcp 80
ACCEPT net fw udp 80
ACCEPT net loc tcp 80
ACCEPT net loc udp 80
ACCEPT loc net tcp 80
ACCEPT loc net udp 80
ACCEPT all dmz tcp 80
That line there says everyone on the side can go out to any website in the world on plaintext. same occurs elsewhere for https on 443. you 'd really want to take out just about all of these rules allow the local network to go anywhere, and then put in specific pinholes.
 
Old 10-17-2013, 03:53 AM   #8
sandeepc04
Member
 
Registered: Jun 2012
Location: India
Posts: 66

Original Poster
Rep: Reputation: Disabled
Hi acid_kewpie,

Thanks for your reply, Here i have tried what you said me to do, as per my before post rule file i have commented
#ACCEPT loc net tcp 80
#ACCEPT loc net udp 80
this 2 lines, but even its not working as per my requirement, so I have commented more 2 lines
#ACCEPT loc net tcp 53
#ACCEPT loc net udp 53
in this case clients not able to access internet without IE setting proxy... here everything is blocking....

but here i am getting 2 more problems
1. Client are not able to ping any website by name like ping www.google.com yahoo.com (By IP able to ping any sites)
2. DMZ line is not working (Internet is not working in one more line) (In shorewall server I have done setup like eth0 for net means direct lease line IP, eth1 is for DMZ means public IP's which we have got free 14 IP's with lease line , eth2 is for loc for local lan... if i need to use that 14 free IP's means i have to route main lease line IP and this free IP's then only i can use as direct public IP..)
Here I am getting problem in direct free 14 IP's are not working internet...


where again i m doing mistake please help me out...

Regards,
Sandeep CC

Last edited by sandeepc04; 10-17-2013 at 03:56 AM.
 
Old 10-17-2013, 04:55 AM   #9
sandeepc04
Member
 
Registered: Jun 2012
Location: India
Posts: 66

Original Poster
Rep: Reputation: Disabled
Even when i do this all setting without proxy by IP address i can open any websites... exp: 74.125.128.103 google.com can open without proxy setting...

That means by dns is blocking internet for client if clients are not setting IE proxy setting...

I think somewhere is missing my configuration... Please let me know where i can correct my setup..


Regards,
Sandeep CC
 
Old 10-17-2013, 05:00 AM   #10
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974
so youre two problems: 1) You blocked DNS so of course they can't reach them. If you don't know what these port numbers and servcies mean, should you be changing them? 2) this seems unrelated to commenting out those lines, until the DMZ boxes somehow rely on a service that does live in the "loc" network.

As for still accessing by IP. You've not blocked 443, are you just using https to get there rather than http? As you say DNS did stop working, you are presumably applying these changes correctly so something else is relevant to the web connections. Maybe you've also got a transparent proxy running on that box which is separately intercept and redirecting the requests?
 
Old 10-17-2013, 05:14 AM   #11
sandeepc04
Member
 
Registered: Jun 2012
Location: India
Posts: 66

Original Poster
Rep: Reputation: Disabled
Thanks,

actually 443 is not opened from loc net , its net loc , even shall I REJECT below lines?
ACCEPT net loc tcp 443
ACCEPT net loc udp 443


Sorry this is 1st time i am using shorewall, before someone has done some setup and left, now i had tried something and something gone in hell, thats what i wanna correct it...

My requirement is,

Any client should not access internet without proxy, even if he use any kind of DNS 8.8.8.8 etc...and he should able to ping by name or IP... also all 3 Lines need to access internet (Direct net line, public free IP's dmz, and loc local network lan)

Regards,
Sandeep CC

Last edited by sandeepc04; 10-17-2013 at 05:19 AM.
 
Old 10-17-2013, 06:03 AM   #12
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974Reputation: 1974
to me it sounds like you may be transparently proxying. i've no idea how whatever configuration you have would make squid d this within shorewall, so can't guide you there. A full "iptables -vnL" might be handy to clarify. You'd certainly want to blcok https on 80 and https on 443 though. morevoer, you should be blocking EVERYTHING by default, only opening by exception.
 
Old 10-24-2013, 02:56 AM   #13
sandeepc04
Member
 
Registered: Jun 2012
Location: India
Posts: 66

Original Poster
Rep: Reputation: Disabled
Hi chris,

sorry i have tried with all ways but finally i failed to correct my mistakes...

As per my requirement I am unable to setup my network...

I am not understanding where I am doing mistakes (shorewall or squid server or iptables)... I can provide you my all setup files if you can find out exact problem... I am ready to configure totally newly serer if you guide me...

Just I need all my clients need to get internet vai my squid server, and if they use any inside or outside DNS IP they should not get blocked websites...

Thanks for your help...

Scenario of my network...

I have configured RHEL server as router by using shorewall software (Having 3 NIC cards) Configured eth0 to direct lease line IP, eth1 configured 14 free public IP's (this IP's got freely with lease line, I can use this IP's as public IP, But i must need to do routing for this), eth2 configured for local network...by this free IP's I have taken 1 IP and configured squid server on RHEL-5 (Same squid configured for DHCP also, all clients getting dhcp IP + Internet by this IP/squid server)... In this squid server i have blocked all unwanted sites....Users are removing proxy setting from IE and giving 8.8.8.8 DNS and using internet so that client is getting internet from direct router server so he is able to open all websites...

Regards,
Sandeep CC

Last edited by sandeepc04; 10-24-2013 at 03:04 AM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Global prob with server johnh10000 Linux - Server 5 09-15-2010 12:26 PM
LXer: OpenClinica Global Conference to Bring Together Global Community for Open Sourc LXer Syndicated Linux News 0 01-08-2010 11:50 AM
How to check the cpu utilization on all non global zones from Global Zone rajaniyer123 Solaris / OpenSolaris 3 10-09-2008 02:43 AM
how do i configure global DNS server? rameshkarajada Linux - Server 3 01-20-2008 06:41 PM
global proxy server for internet LancerNZ Linux - Networking 1 03-12-2005 04:03 AM


All times are GMT -5. The time now is 12:19 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration