I've finished my test this morning. There is a question that I don't know exactly the way to solve. Hope someone here can help me solve out.

There are 3 PCs and one Proxy Server connect to firewall in network 172.16.1.0/16. Firewall has 2 interface.

Internal interface: eth0 with ip address 172.16.1.1
External interface: eth1 IP 10.0.0.1

How to let Proxy server connects to Internet through firewall? And how to let other PCs connect to Internet through Proxy Server?

OK, well you probably don't want a standard NAT, and you also want to enable ip forwarding on the firewall. BTW, You've not mentioned the word "Linux" in any of this... this IS a linux firewall, right?? This will get the routing / natting sorted:

sysctl -w net.ipv4.ip_forward=1 (edit this in /etc/sysctl.conf to make it permanent.
iptables -t nat -A POSTROUTING -s 172.16.1.XXX -o eth1 -j MASQUERADE

Where XXX is the proy server IP. After that you will still want responsible firewall rules to control the access in general.

1 members found this post helpful.

yes, it is linux firewall. thank you for your fast reply.

I did exactly what you tell in this post for letting only Proxy Server connect to Internet through firewall. And let other PCs connect to Internet through Proxy Server (they can't connect directly to Internet), I add the following rule:

iptables -A INPUT -d 172.16.1.XXX -p all -j ACCEPT (XXX is the proxy server IP)

Is is OK? I'm totally not sure about this

well that as a rule by itself will work - Oh no, you've got -d (destination) instead of is (source) for the proxy so you'd want to change that, but if it's appended it may be after a default deny so wouldn't get reached etc. "iptables -vnL" will show the full ruleset in context. I would not advise allowing *everything* through from it. From its role as a proxy it should only need tcp ports 80 and 443. You should also only be permitted new traffic explicitly on that rule, but that's something of a subtlety that won't affect you right now.