Hello,
My iptables config file is as follows :

# Generated by iptables-save v1.2.9 on Fri Jan 7 20:56:35 2000
*nat
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Fri Jan 7 20:56:35 2000
# Generated by iptables-save v1.2.9 on Fri Jan 7 20:56:35 2000
*mangle
:PREROUTING ACCEPT [1024:195745]
:INPUT ACCEPT [1019:194076]
:FORWARD ACCEPT [2:144]
:OUTPUT ACCEPT [1000:192114]
:POSTROUTING ACCEPT [999:192086]
COMMIT
# Completed on Fri Jan 7 20:56:35 2000
# Generated by iptables-save v1.2.9 on Fri Jan 7 20:56:35 2000
*filter
:FORWARD ACCEPT [0:0]
:INPUT DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -j ACCEPT
-A INPUT -s 127.0.0.1 -j ACCEPT
-A INPUT -p tcp -m tcp -i eth1 --dport 3128 --sport 80 -j ACCEPT
-A INPUT -p udp -m udp -i eth1 --dport 3128 --sport 80 -j ACCEPT
-A INPUT -s 62.0.0.0/255.0.0.0 -i eth0 -j REJECT
-A INPUT -p tcp -m tcp -s 217.81.0.0/255.255.0.0 -i eth0 -j REJECT
-A INPUT -i eth0 -j DROP
-A INPUT -p tcp -m tcp -i eth1 --sport 80 -j DROP
-A INPUT -m state -i eth1 --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -p tcp -i eth1 -o eth0 --dport 25 --sport 1024: -j ACCEPT --syn
-A FORWARD -p tcp -i eth1 -o eth0 --dport 110 --sport 1024: -j ACCEPT --syn
-A FORWARD -p tcp -i eth1 -o eth0 --dport 1863 --sport 1024: -j ACCEPT --syn
-A FORWARD -p tcp -i eth1 -o eth0 --dport 5050 --sport 1024: -j ACCEPT --syn
-A OUTPUT -p udp --dport 53 --sport 1024: -j ACCEPT
-A OUTPUT -p tcp -m owner -o eth0 --dport 80 --sport 1024: --uid-owner squid -j ACCEPT --syn
COMMIT
# Completed on Fri Jan 7 20:56:35 2000


mails part is working

MSN is working.

I am able to browse without any proxy settings.
Which I do not want.

I need browsing only through squid proxy

Thanks for all the help so far.

Varun

hi there

what do you mean by this

"I am able to browse without any proxy settings.
Which I do not want. "

you will have to use squid proxy server explicitly in ur applications and stop masquerading/NAT

regards

You need to stop your firewall from forwarding traffic on port 80
Add a
-A FORWARD -p tcp -i eth1 -o eth0 --dport 80 -j REJECT
after the
-A FORWARD -m state --state... entry

Note that this will only prevent your users from reaching webservers on port 80 (the standard one).
If anyone has a proxy (or web) server on the outside running on another port they can still circumvent squid.

One solution to that is to REJECT all FORWARD ports and only open the necessery ports.

- Peder

Eh, I believe that Squid supports transparent proxy.

In this case you do NOT do as posted above but rather configure squid to intercept port 80 requests and deal with them itself, hence the "transparent" term, as the user is unaware of this and no client configuration changes are required.

Search for "transparent" in the squid.conf file.

But you cannot have any auth with transparent proxy.
I want auth.

Well, you didn't say anything about this originally.

Qualifying the question properly helps with any suggestions.


However I don't understand the problem.

Auth is used with an Apache web SERVER, this has nothing to do with squid.

Squid merely caches internet bound web requests, not inbound ones to your own Apache server.

Please clarify and provide far more detail.

You can set up squid to require authentication before accepting proxy requests.

@opjose: He said he didn't want users to be able to browse w/o proxy settings. Why isn't really that important, though I
agree the more info we get the easier it is to help.

I think my answer is the way to go and in addition, I you could add this after the "-A POSTROUTING -o eth0 -j MASQUERADE" :
-A PREROUTING -o eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128

This rule makes every outgoing request to port 80 be redirected to squid. This way you don't have to configure the browser
to point to the squid proxy. As long as the PC has the squid server as it's gateway it will be sent through the proxy.

- Peder

Ok,
The reason for auth is that only those who are
autuorized to have access to internet get it and
others don't get it

Varun

Ok,
The reason for proxy settings + auth is that only those
who are autuorized to have access to internet get it and
others don't get it

Varun

Yes this will work without problem, although Squid already has it's own mechanism to intercept outbound HTTP requests transparently which prompted my original suggestion.

See next message as I believe it still applies...

Ah, ok, that is what ACL's are for.

Squid supports ACL control which permits you to do this.

In addition once it's set up you can easily control it's behavior via the Webmin interface, and adjust ACL's on the fly.

For the non-initiated, ACL's = Access Control Lists