Squid restrictions and discriminating iptables rulesets

ochienged · 07-22-2008, 05:55 AM

I am downed with the task of giving a group of employees where i work restriction to certain sites during working hours. Now here comes my questions:

1. How can i put down my "http_access" rules, having in mind that I need to restrict a certain range of IP's from accessing certain sites during working hours using squid. Consider, the scenario below:

Code:

acl RECEPTIONISTS src 192.168.0.20-192.168.0.30
acl WORK_HOURS time M T W H F 8:30-16:00
acl BAD_DOMAINS dstdom_regex -i "/etc/squid/bad_domains"

2. How can I configure iptables ruleset such that these range of IP's can't forward their requests directly to the gateway?
My problem is working with a range of IP addresses

win32sux · 07-22-2008, 06:15 AM

Quote:

Originally Posted by ochienged

1. How can i put down my "http_access" rules, having in mind that I need to restrict a certain range of IP's from accessing certain sites during working hours using squid. Consider, the scenario below:

Code:

acl RECEPTIONISTS src 192.168.0.20-192.168.0.30
acl WORK_HOURS time M T W H F 8:30-16:00
acl BAD_DOMAINS dstdom_regex -i "/etc/squid/bad_domains"

Basically you just use a deny rule like:

Code:

http_access deny RECEPTIONISTS WORK_HOURS BAD_DOMAINS

Quote:

2. How can I configure iptables ruleset such that these range of IP's can't forward their requests directly to the gateway?
My problem is working with a range of IP addresses

Assuming you mean through the gateway, here's an example:

Code:

iptables -I FORWARD -i eth0 -o eth1 \
-m iprange --src-range 192.168.0.20-192.168.0.30 -j REJECT

ochienged · 07-22-2008, 07:08 AM

Thanks a lot win32sux. All your responses worked well. If I may ask,

Quote:

What do I need to do to make the proxy server intercepting (or transparent)?

Considering that the internet gateway is also the mail server.

win32sux · 07-22-2008, 08:13 AM

Quote:

What do I need to do to make the proxy server intercepting (or transparent)?

Two things. First, you need to tell Squid you want it to run in transparent mode. How you do that depends on the version you have (let us know). Second, you need an iptables rule which redirects (to Squid) HTTP traffic which was meant to be NATed - something like:

Code:

iptables -A PREROUTING -p TCP -i $LAN_IFACE --dport 80 \
-j REDIRECT --to-ports 3128

ochienged · 07-22-2008, 09:23 AM

This means that the only thing that is not done is, setting squid to run in transparent mode. The version of squid am running is:

Quote:

[root@mail squid]# rpm -q squid
squid-2.6.STABLE6-5.el5_1.3

Its running on:

Quote:

CentOS release 5 (Final)

And my NAT table appears as shown below:

Quote:

Chain PREROUTING (policy ACCEPT)
target prot opt source destination
REDIRECT tcp -- 192.168.0.0 anywhere tcp dpt:http redir ports 3128

win32sux · 07-22-2008, 05:14 PM

Quote:

Originally Posted by ochienged

This means that the only thing that is not done is, setting squid to run in transparent mode. The version of squid am running is:

Code:

[root@mail squid]# rpm -q squid
squid-2.6.STABLE6-5.el5_1.3

Then all you need to do is find the http_port line in your squid.conf and add "transparent" to it. Like, for example:

Code:

http_port 3128 transparent

PS: Please use CODE tags instead of QUOTE tags when posting output and stuff like that. It makes things display better and it makes it a lot easier to quote the relevant parts of your post when replying to it.

ochienged · 07-31-2008, 02:25 AM

Thanks a lot. I succeeded in my endeavours when in the iptables i redirect http requests to

Quote:

iptables -A PREROUTING -p TCP -i $LAN_IFACE --dport 80 \
-j REDIRECT --to-ports squidserver_ip:3128