Download your favorite Linux distribution at LQ ISO.
Go Back > Forums > Linux Forums > Linux - Security
User Name
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.


  Search this Thread
Old 06-02-2010, 03:53 AM   #1
Registered: Oct 2005
Posts: 334

Rep: Reputation: 32
iptables forward to new chain

I've created a iptables scripts wherein it will act as a gateway and redirect all port 80 to squid and block other ports. However, you would notice that is exempted on squid and wasn't include on the port blocking. can surf the net and can do p2p,torrent,etc.

Could anyone advise how could I make access the Internet by bypassing port 80 redirection and can only connect to 110 and 143. Connecting to other ports should be block. I tried to create a new chain and feed there but it seems it was block on all ports. I cannot query pop3 and imap but I could browse the Internet since I'm bypassing port 80 redirection

Here is my additional parameters that didn't work:
iptables -N USERS
iptables -A USERS -p tcp --dport ! 110 -j REJECT
iptables -A USERS -p tcp --dport ! 143 -j REJECT
iptables -A FORWARD -p TCP -i $LAN_IN -s --dport ! 80 -j USERS
iptables -t nat -A PREROUTING -i $LAN_IN -p tcp -s --dport 80 -j ACCEPT
Here is my script without those commands above

# Interface connected to Internet
# Interface connected to LAN
# Squid port

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -P INPUT DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -i $INTERNET -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i $LAN_IN -j ACCEPT
iptables -A OUTPUT -o $LAN_IN -j ACCEPT
iptables --table nat --append POSTROUTING --out-interface $INTERNET -j MASQUERADE
iptables -A FORWARD -p TCP -i $LAN_IN --dport ! 80 -s -j ACCEPT
iptables -A FORWARD -p TCP -i $LAN_IN --dport ! 80 -s -j REJECT
iptables -t nat -A PREROUTING -i $LAN_IN -p tcp -s --dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -i $LAN_IN -p tcp --dport 80 -j REDIRECT --to-ports 8080
iptables -A INPUT -j DROP
Old 06-02-2010, 06:45 AM   #2
LQ Guru
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 380Reputation: 380Reputation: 380Reputation: 380
Originally Posted by packets View Post
Could anyone advise how could I make access the Internet by bypassing port 80 redirection and can only connect to 110 and 143. Connecting to other ports should be block.
No need to build a chain. Example:
iptables -A FORWARD -p TCP -i $LAN_IN -o $INTERNET \
-s -m multiport --dports ! 143,110,80 -j REJECT

iptables -t nat -A PREROUTING -i $LAN_IN -s -j ACCEPT
Make sure this PREROUTING rule goes before your REDIRECT one.

As a side note, don't you think all this inverted matching just makes stuff more confusing than it should be? BTW, you should look into setting your FORWARD policy to DROP, and only allowing packets in states RELATED and ESTABLISHED from the Internet side, as it doesn't seem like you're running any services there. You could then remove this inverted match in my example and change the target to ACCEPT.

Last edited by win32sux; 06-02-2010 at 06:47 AM.


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
iptables FORWARD chain allow back connections niteshadw Linux - Networking 3 04-23-2010 11:39 AM
On what basis CHAIN integer values are generated in IPtables under iptables file? haariseshu Linux - Server 3 11-05-2009 04:25 AM
iptables good packet chain (instead of bad packet chain) win32sux Linux - Security 6 11-06-2008 06:02 AM
How to get packets into the forward chain? marting Linux - Server 2 09-17-2008 02:15 AM
Iptables redirect AFTER INPUT/FORWARD chain processing tunasashimi Linux - Networking 0 07-09-2007 03:40 AM > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 02:17 PM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration