LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 10-02-2003, 08:42 AM   #1
sedulous
LQ Newbie
 
Registered: Aug 2003
Posts: 24

Rep: Reputation: 15
Iptables & squid issues


Good evening,

Well I got squid running and I love it.

To the point. I can only access ports > 1024 and the http port thorugh the squid proxy on 192.168.0.1.


edit: I think this is the culprit.

# Squid Server
#
/sbin/iptables -A INPUT -i $extint -p tcp --sport 80 -d $extip --dport 1024:65535 -j ACCEPT

I want to allow the squid proxy, but i want to allow all ports being used on the internal network computers.

I'll post my iptables script a little further down.

I think the squid line (scroll down a little) in English, is:
For iptables input if the interface is the one connected to the internet (external) and its TCP, the source port is 80, and if the destination port is between the range of 1024:65535 then accept it. - Can anyone correct me here ?

I've tried many combinations, alternatives of that line, to no avail.

When I restart and flush iptables, all that I need to do is 'service iptables stop' then run the script? I disabled the lokkit redhat firewall aswell.



Please can anyone help,

Thanks in advance,

Matthew





############ Iptables setup ###############
extint="eth1" # External Interface (internet)
intint="eth0" # Internal Interface (internal lan)
extip="1.2.3.4.5.6.7.8.9" # External IP
intip="192.168.10.1" # Internal IP
#
# Enable ipforward, ping echos and ipdynamic addressing
#
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "1" > /proc/sys/net/ipv4/ip_dynaddr
echo "0" > /proc/sys/net/ipv4/icmp_echo_ignore_all
echo "0" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
#
###############################################

###############################################
#
# Set input, forward policies to DROP everything
# and flush existing rules
#
/sbin/iptables -P INPUT DROP
/sbin/iptables -F INPUT
/sbin/iptables -P FORWARD DROP
#we want to allow everything out
/sbin/iptables -P OUTPUT ACCEPT
/sbin/iptables -F OUTPUT
#
###############################################
#
# Enable local interface
#
/sbin/iptables -A INPUT -i lo -j ACCEPT
#
# End local services
#
###############################################

# Squid Server
#
/sbin/iptables -A INPUT -i $extint -p tcp --sport 80 -d $extip --dport 1024:65535 -j ACCEPT

###############################################
#
# accept all pings
#
/sbin/iptables -A INPUT -i $extint -p icmp -j ACCEPT
#
###############################################



# Masquerade and Transparent Proxying
#
# masq LAN traffic
/sbin/iptables -t nat -A POSTROUTING -o $extint -j MASQUERADE
#
# redirect all LAN clients to the filtering port
/sbin/iptables -t nat -A PREROUTING -i $intint -p tcp --dport 80 -j REDIRECT --to-port 3128

# Allow established and related packets back in:
iptables -A INPUT -i eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -i eth1 -j ACCEPT
#Forward ident port to Dell Inspiron
iptables -A PREROUTING -t nat -p tcp -i eth1 --dport 113 -j DNAT --to 192.168.0.4
#If all else fails
#iptables -A INPUT -p ALL -i eth0 -s 192.168.0.0/24 -j ACCEPT

Last edited by sedulous; 10-02-2003 at 09:50 PM.
 
Old 10-05-2003, 02:28 AM   #2
clacour
Member
 
Registered: Sep 2003
Location: Dallas, Tx, USA
Distribution: Red Hat, Gentoo, Libranet
Posts: 98

Rep: Reputation: 16
From your description, your internal machines would be coming in on the $intint. You might want to set up a rule for those machines similar to the current one for squid and try changing that. Changes made to the existing squid line would only affect the external interface.

You might even want to do something like this:
#If all else fails
#iptables -A INPUT -p ALL -i eth0 -s 192.168.0.0/24 -j ACCEPT
iptables -A INPUT -p ALL -i $intint -s 192.168.0.0/24 -j ACCEPT

Hope this helps,

CHL
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
iptables+squid alcor Linux - Networking 1 11-02-2005 05:13 PM
IM blocking with combination of IPtables & Squid shamza Linux - Security 1 09-29-2005 01:00 AM
Squid POP3 & SMTP issues mcatman Linux - Networking 5 02-28-2005 10:12 AM
squid + iptables varun_saa Mandriva 10 02-11-2005 09:27 PM
long lastin troubles with iptables & squid karpo66 Linux - Networking 0 01-23-2005 09:34 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 05:00 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration