LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 09-20-2010, 02:19 PM   #1
Falchion
LQ Newbie
 
Registered: Sep 2010
Posts: 5

Rep: Reputation: 0
IPTABLES need help filtering proxy connection


We have 2 proxy server, 192.168.0.1 & 192.168.0.2. Both of them connect to different ISP.

Each of our client use IE proxy that connect to 192.168.0.2:3128, but all of them use 192.168.0.1 as their primary gateway setting. Don't ask why, it's a long story.

We want to filter the connection to let say 222.222.222.222, so that everyone that type that address in IE will be forced to use 192.168.0.1:3128 proxy.

I tried putting this in 192.168.0.2 firewall rules:
iptables -t nat -A PREROUTING -i ${L/WAN} -p tcp -d 222.222.222.222 -j DNAT --to 192.168.0.1:3128
or
iptables -t nat -A OUTPUT -p tcp -d 222.222.222.222 -j DNAT --to 192.168.0.1:3128
or
iptables -t nat -A POSTROUTING -i ${L/WAN} -p tcp -d 222.222.222.222 -j SNAT --to 192.168.0.1:3128

and none of them work.... how do I filter a connection that already use proxy?
 
Old 09-20-2010, 05:59 PM   #2
estabroo
Senior Member
 
Registered: Jun 2008
Distribution: debian, ubuntu, sidux
Posts: 1,126
Blog Entries: 2

Rep: Reputation: 124Reputation: 124
wouldn't this be easier to solve by using one of the pac files for IE proxy setup, lets you list rules for which proxy certain addresses should be sent too.

http://en.wikipedia.org/wiki/Proxy_auto-config
 
Old 09-20-2010, 10:05 PM   #3
Falchion
LQ Newbie
 
Registered: Sep 2010
Posts: 5

Original Poster
Rep: Reputation: 0
Quote:
Originally Posted by estabroo View Post
wouldn't this be easier to solve by using one of the pac files for IE proxy setup, lets you list rules for which proxy certain addresses should be sent too.

http://en.wikipedia.org/wiki/Proxy_auto-config
is this done in the client or the server?
because I need it done in the proxy server itself in case the list changed. It'll be too much hassle to change configuration in all our clients' computer.
 
Old 09-21-2010, 07:02 AM   #4
linuxlover.chaitanya
Senior Member
 
Registered: Apr 2008
Location: Gurgaon, India
Distribution: Cent OS 6/7
Posts: 4,629

Rep: Reputation: Disabled
The proxy auto config file has to be on the server and clients link to the file. You need to set the browser to auto detect proxy settings.
 
Old 09-21-2010, 12:47 PM   #5
Falchion
LQ Newbie
 
Registered: Sep 2010
Posts: 5

Original Poster
Rep: Reputation: 0
Quote:
Originally Posted by linuxlover.chaitanya View Post
The proxy auto config file has to be on the server and clients link to the file. You need to set the browser to auto detect proxy settings.
ok, because this seems like my only options.... how do I start? what should I emerge? is there a tutorial on how to install this?
 
Old 09-22-2010, 12:49 AM   #6
linuxlover.chaitanya
Senior Member
 
Registered: Apr 2008
Location: Gurgaon, India
Distribution: Cent OS 6/7
Posts: 4,629

Rep: Reputation: Disabled
You do not install it. You need to write a script that is basically more of a JS. And then configure your DNS for wpad. Take a look at the link in the above post for reference. The scripts in the link may just work for you the way they are.
 
Old 09-22-2010, 01:25 AM   #7
Falchion
LQ Newbie
 
Registered: Sep 2010
Posts: 5

Original Poster
Rep: Reputation: 0
Quote:
Originally Posted by linuxlover.chaitanya View Post
You do not install it. You need to write a script that is basically more of a JS. And then configure your DNS for wpad. Take a look at the link in the above post for reference. The scripts in the link may just work for you the way they are.
? don't quite get it.
I just read the requirement for WPAD and I read this "The file named wpad.dat must be located in the WPAD web site's root directory."

I got the impression that this might not be what I was looking for.... because the destination 222.222.222.222 I'm referring to is not our web server, it's public.

I just need to filter connection coming from LAN(192.168.0.1/24, eth0) to determine which ISP that particular client should use to connect to a certain public website(in my example 222.222.222.222).

Last edited by Falchion; 09-22-2010 at 01:27 AM.
 
Old 09-22-2010, 01:35 AM   #8
linuxlover.chaitanya
Senior Member
 
Registered: Apr 2008
Location: Gurgaon, India
Distribution: Cent OS 6/7
Posts: 4,629

Rep: Reputation: Disabled
Are you looking for load balancing or connecting to internet using two different providers?
Something like this?

http://www.shorewall.net/MultiISP.html

http://linux-ip.net/html/adv-multi-internet.html
 
Old 09-22-2010, 04:24 AM   #9
Falchion
LQ Newbie
 
Registered: Sep 2010
Posts: 5

Original Poster
Rep: Reputation: 0
Quote:
Originally Posted by linuxlover.chaitanya View Post
Are you looking for load balancing or connecting to internet using two different providers?
Something like this?

http://www.shorewall.net/MultiISP.html

http://linux-ip.net/html/adv-multi-internet.html
no, just need iptables rules to separate destination. if iptables can't do it then somekind of squid patch or any other ideas.

we use 2 different server/router in which each connect to different ISP.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Content Filtering without a Proxy mikes63737 Linux - Networking 8 05-24-2016 03:25 PM
Need to know how to use Squid proxy for content filtering surangar Linux - Newbie 2 03-10-2009 03:51 AM
filtering with iptables behind a proxy torgeir.nes Linux - Server 2 05-24-2007 01:27 AM
DNS proxy w/filtering uselpa Linux - Software 2 01-14-2006 04:41 AM
SMTP proxy for spam filtering todesengel Linux - Software 2 09-10-2003 11:05 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 04:20 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration