Re: [squid-users] Re: [help] setting up firewall policy for transparent (single-homed host) proxy

Rachmat Hidayat Al Anshar wrote:
> Hi Amos...
>
> Mmmm...its giving an feedback after I issuing " iptables -A FORWARD --dport 80 -s $SQUID -j ACCEPT"
> it says "unknown arg --dport", maybe the FORWARD chain can't proceed without any other
> switch (parameter)...

Hmm, arg. I think after a closer look all I can think of is I got the
parameter order wrong :-(
It should probably be -s then --dport

Sorry
Amos

>
> Thanks
> Rachmat Hidayat Al Anshar
>
>
> ----- Original Message ----
>> From: Amos Jeffries <squid3@treenet.co.nz>
>> To: Rachmat Hidayat Al Anshar <rachmat_hidayat_03@yahoo.com>
>> Cc: squid cache <squid-users@squid-cache.org>
>> Sent: Thursday, January 10, 2008 7:45:44 PM
>> Subject: Re: [squid-users] Re: [help] setting up firewall policy for transparent (single-homed host) proxy
>>
>> Rachmat Hidayat Al Anshar wrote:
>>> I am stuck on confuse...
>>> I have no idea with this...
>>> I trying to configure the iptables only with this following command
>>> (with default policy set to ACCEPT)
>>> iptables -t nat -A PREROUTING -i eth0 -s ! squid-box -p tcp
>> --dport
>>
> 80 -j DNAT --to squid-box:3128
>> iptables -t nat -A POSTROUTING -o eth0 -s local-network -d squid-box
>> -j
>>
>
>> SNAT --to iptables-box
>>
>> iptables -A FORWARD -s local-network -d squid-box -i eth0 -o eth0
>> -p
>>
> tcp
>> --dport 3128 -j ACCEPT
>>
>> note:
>>> - eth0 -> internal device
>>
>> Try JUST this (one command to a line, I've split them to wrapping
>> can
>>
> be
>> seen clearly):
>>
>> SQUID=10.0.0.0 - or whatever the squid box IP is.
>>
>> iptables -t nat -A PREROUTING -i eth0 -s !$SQUID -p tcp --dport 80 -j
>> DNAT --to $SQUID:3128
>>
>> iptables -A FORWARD --dport 80 -s $SQUID -j ACCEPT
>>
>> iptables -A FORWARD --dport 80 -j REJECT
>>
>>
>> Amos
>>
>>> My proxy box was ignored...
>>> I have configured squid with some access control, to block
>> some
>>
> words, domains, an IPs.
>>> I tested to access the web box outside the network, here's
>> the
>>
> result:
>>> - the sites was opened successfully
>>> - when i try to adding a "blocked word" (such as "porn")..
>>> the sites also successfully open the page...
>>> Squid was ignored...
>>> What should I do...
>>> Help me guys...
>>>
>>>
>>> Thanks
>>> Rachmat Hidayat Al Anshar
>>>
>>>
>>>
>>>
>>> ----- Original Message ----
>>>> From: Rachmat Hidayat Al Anshar
>>>> To: squid cache
>>>> Cc: Chris Zhang
>>>> Sent: Thursday, January 10, 2008 3:50:24 PM
>>>> Subject: [squid-users] Re: [help] setting up firewall policy
>> for
>>
> transparent (single-homed host) proxy
>>>> ----- Original Message ----
>>>>> From: Chris Zhang
>>>>> To: Rachmat Hidayat Al Anshar
>>>>> Sent: Thursday, January 10, 2008 2:12:48 PM
>>>>> Subject: Re: [help] setting up firewall policy for
>>>> transparent
>>>>
>>> (single-homed host) proxy
>>>>> Hi Rachmat,
>>>>>
>>>>>
>>>>> Did you take that line out and then tried it again and it still
>>>>> didn't work?
>>>> Yes I do, I have done with it, and the proxy box still ignored
>>>>
>>>>> I don't think you need to recompile Squid, you need to change
>>>>> /etc/squid.conf file as suggested by the link I pointed to
>> you.
>>
> More
>>>>> specifically, make sure you have these lines,
>>>>>
>>>>> * httpd_accel_host virtual
>>>>> * httpd_accel_port 80
>>>>> * httpd_accel_with_proxy on
>>>>> * httpd_accel_uses_host_header on
>>>>>
>>>> I also finish with it...
>>>>
>>>>> Also I am a bit confused with the setup you had there. Does
>>>> your
>>>>
>>> squid
>>>>> machine have a public IP? My understanding is that all your
>>>> computers
>>>>
>>>
>>>>> that are behind the firewall are NATed, this also includes
>>>> your
>>>>
>>> Squid.
>>>>
>>>> All of this deployed at vmware, the virtual environment.
>>>> There is only an example of public environment. And you're
>>>> correct, my squid box located behind firewall (also act as
>> nat
>>
> device).
>>>>> The idea with a transparent proxy is that you configure all client
>>>>> computers to use the gateway, on the gateway you have rules which
>>>>> say
>>>>>
>>>> if
>>>>> the outgoing port is port 80, and the traffic is coming from
>>>>> your
>>>>>
>>>> client
>>>>> machines, redirect those traffic to your Squid machine on
>> port
>>
> 3128.
>>>>> 'iptables -t nat -A PREROUTING -i eth0 -d iptables-box -p tcp
>>>>> --dport
>>>>>
>>>> 80 -j ACCEPT' is saying if the traffic is going INTO the gateway
>>>>> (in
>>>>>
>>>> your case these traffic originate from the clients), and if
>>>>> the
>>>>>
>>>> destination port is port 80, protocol is tcp, accept it.
>>>>
>>>> Yep, its correct.
>>>> ### Squid Transparent Proxy
>>>> iptables -t nat -A PREROUTING -i eth0 -d iptables-box -p tcp
>> --dport
>>
> 80
>>>> -j ACCEPT
>>>> iptables -t nat -A PREROUTING -i eth0 -s ! squid-box -p tcp
>> --dport
>>
> 80
>>>> -j DNAT --to squid-box:3128
>>>>
>>>> iptables -t nat -A POSTROUTING -o eth0 -s local-network -d
>> squid-box
>>
> -j
>>>> SNAT --to iptables-box
>>>> iptables -A FORWARD -s local-network -d squid-box -i eth0 -o eth0 -p
>>>> tcp --dport 3128 -j ACCEPT
>>>>
>>>>> But you really want this line '
>>>>> iptables -t nat -A PREROUTING -i eth0 -s ! squid-box -p tcp --dport
>>>>> 80
>>>>>
>>>> -j DNAT --to squid-box:3128' which is the line after the
>> first
>>
> line.
>>>>> The result of having this first line before the second line (
>>>>> iptables
>>>>>
>>>> -t nat -A PREROUTING -i eth0 -s ! squid-box -p tcp --dport 80 -j
>>>>> DNAT
>>>>>
>>>> --to squid-box:3128 ) is that the second line will never catch
>>>>> any
>>>>>
>>>> traffic.
>>>>> Please
>>>>> see
>>>>>
>>>> http://www.faqs.org/docs/Linux-mini/TransparentProxy.html#ss2.3
>> .
>>
> It
>>>>> is
>>>>>
>>>> exactly what you need.
>>>>> Chris
>>>>>
>>>>>
>>>> I have done following steps on
>>>> this
>>>>
>>> http://www.faqs.org/docs/Linux-mini/TransparentProxy.html#s6
>>>> But my proxy still ignored. How is it?
>>>> I'll try it once more...anyway...
>>>>
>>>> Thanks
>>>> Rachmat Hidayat Al Anshar
>>>>
>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> Rachmat Hidayat Al Anshar wrote:
>>>>>> Hay ho Chris,
>>>>>> Thanks for replying.
>>>>>>
>>>>>> First of all, I have reference to that link, but in other
>>>>> disscussion
>>>>>
>>>> forum
>>>>>> I found someone out there says that...
>>>>>> " The traffic is being caught by the first rule, since
>>>> the
>>>>
>>> connection
>>>>>> probably isn't coming from the squid box. Before that rule,
>>>> you
>>>>
>>> need
>>>>>> to put in an ACCEPT for http packets aimed at the firewall box:
>>>>>> iptables -t nat -A PREROUTING -i eth0 -d iptables-box -p tcp \
>>>>>> --dport 80 -j ACCEPT"..something like that...
>>>>>> I have been trying for many times, and I still can't solve
>>>>> this
>>>>>
>>>> problem.
>>>>>> Is it about compiling options,
>>>>>> What command that I have to issue to get informed, what configure
>>>>>> option that squid used to compile at compiling process for a
>>>>> first
>>>>>
>>>> time???
>>>>>> Can we re-compile squid? If so, what should I do?
>>>>>>
>>>>>> Thanks in advance
>>>>>> Rachmat Hidayat Al Anshar
>>>>>>
>>>>>>
>>>>>>
>>>>>> ----- Original Message ----
>>>>>>
>>>>>>> From: Chris Zhang
>>>>>>> To: Rachmat Hidayat Al Anshar
>>>>>>> Cc: linux@lists.samba.org
>>>>>>> Sent: Wednesday, January 9, 2008 7:11:46 PM
>>>>>>> Subject: Re: [clug] [help] setting up firewall policy
>>>>> for
>>>>>
>>>> transparent (single-homed host) proxy
>>>>>>> Hi Rachmat,
>>>>>>>
>>>>>>>
>>>>>>> Maybe you want to try it again without this line
>>>>>>>
>>>>>>>
>>>>>>> 'iptables -t nat -A PREROUTING -i eth0 -d iptables-box -p tcp
>>>>>>> --dport
>>>>>>>
>>>>>>>
>>>>>> 80
>>>>>>
>>>>>>> -j ACCEPT'
>>>>>>>
>>>>>>>
>>>>>>> Also I think you will have to change squid.conf file (see
>>>>>>> http://www.faqs.org/docs/Linux-mini/TransparentProxy.html#ss2.3 )
>>>>>>>
>>>>>>>
>>>>>>> Chris
>>>>>>>
>>>>>>>
>>>>>>> Rachmat Hidayat Al Anshar wrote:
>>>>>>>
>>>>>>>> var YAHOO = {'Shortcuts' : {}};
>>>>>>>> YAHOO.Shortcuts.hasSensitiveText = false;
>>>>>>>> YAHOO.Shortcuts.sensitivityType = [];
>>>>>>>> YAHOO.Shortcuts.doUlt = false;
>>>>>>>> YAHOO.Shortcuts.location = "us";
>>>>>>>> YAHOO.Shortcuts.document_id = 0;
>>>>>>>> YAHOO.Shortcuts.document_type = "";
>>>>>>>> YAHOO.Shortcuts.document_title = "[help] setting up firewall
>>>>>>>>
>>>>>>> policy
>>>>>>>
>>>>>>>
>>>>>> for transparent (single-homed host) proxy";
>>>>>>
>>>>>>>> YAHOO.Shortcuts.document_publish_date = "";
>>>>>>>> YAHOO.Shortcuts.document_author
>> =
>>
> "rachmat_hidayat_03@yahoo.com";
>>>>>>>> YAHOO.Shortcuts.document_url = "";
>>>>>>>> YAHOO.Shortcuts.document_tags = "";
>>>>>>>> YAHOO.Shortcuts.annotationSet = {
>>>>>>>> "lw_1199853885_0": {
>>>>>>>> "text": "Yahoo! Mobile",
>>>>>>>> "extended": 0,
>>>>>>>> "startchar": 1530,
>>>>>>>> "endchar": 1542,
>>>>>>>> "start": 1530,
>>>>>>>> "end": 1542,
>>>>>>>> "extendedFrom": "",
>>>>>>>> "predictedCategory": "ORGANIZATION",
>>>>>>>> "predictionProbability": "0.679211",
>>>>>>>> "weight": 0.661212,
>>>>>>>>
>>>>>>>>
>>>>>>> "type":
>>>>>>>
>>>>>>>
>>>>>> ["shortcuts:/us/instance/organization/company/yahoo_property"],
>>>>>>
>>>>>>>> "category": ["ORGANIZATION"],
>>>>>>>> "context": "friend newshound and know-it-all with Yahoo
>>>> Mobile
>>>>
>>> Try
>>>>>>>>
>>>>>>> it
>>>>>>>
>>>>>>>
>>>>>> now",
>>>>>>
>>>>>>>> "metaData": {
>>>>>>>> "yprop_name": "Yahoo! Mobile",
>>>>>>>> "yprop_url": "http://mobile.yahoo.com/"
>>>>>>>> }
>>>>>>>> }
>>>>>>>> };
>>>>>>>>
>>>>>>>> Hi all...
>>>>>>>>
>>>>>>>> I am on my research deploying a transparent single-homed
>>>> host
>>>>
>>> proxy
>>>>>>>> server on my virtual network. My squid box is not on the same
>>>>>>>>
>>>>>>> box
>>>>>>>
>>>>>>>
>>>>>> where the
>>>>>>
>>>>>>>> firewall applied. I didn't have any idea how to set up the
>>>>>>>>
>>>>>>> iptables
>>>>>>>
>>>>>>>
>>>>>> running on
>>>>>>
>>>>>>>> the firewall, so I can redirect all client's web request to my
>>>>>>>>
>>>>>>> proxy
>>>>>>>
>>>>>>>
>>>>>> box,
>>>>>>
>>>>>>>> and make it as the only host on the network may request web
>>>>>>>>
>>>>>>> services
>>>>>>>
>>>>>>>
>>>>>> through
>>>>>>
>>>>>>>> firewall to the Internet...???
>>>>>>>>
>>>>>>>>
>>>>>>>> INTERNET <---> FIREWALL <---> switch <---> NAT DEV<---> INTRANET
>>>>>>>> ^
>>>>>>>> |
>>>>>>>> v
>>>>>>>>
>>>>>>>> squid web
>>>>>>>> proxies
>>>>>>>>
>>>>>>>> I try to use this following firewall script...
>>>>>>>>
>>>>>>>> #!/bin/sh
>>>>>>>> # Firewall Script
>>>>>>>> ###############################################################
>>>>>>>> ### interfaces
>>>>>>>> EXT_DEV=eth0
>>>>>>>> INT_DEV=eth1
>>>>>>>> INT_NET=10.1.1.0/24
>>>>>>>>
>>>>>>>> ### Loading firewall modules
>>>>>>>> modprobe ip_conntrack
>>>>>>>> modprobe ip_conntrack_ftp
>>>>>>>>
>>>>>>>> ###############################################################
>>>>>>>> ### Enable Packet Forwarding
>>>>>>>> echo 1 > /proc/sys/net/ipv4/ip_forward
>>>>>>>>
>>>>>>>> ### Remove all previous rules, and delete any user
>> defined
>>
> chains
>>>>>>>> iptables -F
>>>>>>>> iptables -X
>>>>>>>> iptables -t nat -F
>>>>>>>> iptables -t nat -X
>>>>>>>>
>>>>>>>> ### Set the default policies to drop
>>>>>>>> iptables -P INPUT DROP
>>>>>>>> iptables -P OUTPUT DROP
>>>>>>>> iptables -P FORWARD DROP
>>>>>>>>
>>>>>>>> ### Loopback device OK
>>>>>>>> iptables -A INPUT -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT
>>>>>>>> iptables -A OUTPUT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT
>>>>>>>>
>>>>>>>> ### Allow all ICMP Traffic (optional) - IN, OUT and THROUGH.
>>>>>>>> iptables -A INPUT -p icmp --icmp-type any -j ACCEPT
>>>>>>>> iptables -A OUTPUT -p icmp --icmp-type any -j ACCEPT
>>>>>>>> iptables -A FORWARD -p icmp --icmp-type any -j ACCEPT
>>>>>>>>
>>>>>>>> ### Allow all Internal traffic to Server
>>>>>>>> iptables -A INPUT -i $INT_DEV -s $INT_NET -d $INT_NET -j ACCEPT
>>>>>>>> iptables -A OUTPUT -o $INT_DEV -s $INT_NET -d $INT_NET -j ACCEPT
>>>>>>>>
>>>>>>>> ### OUTBOUND Rule: Allow ALL packets out the external device
>>>>>>>> iptables -A OUTPUT -o $EXT_DEV -j ACCEPT
>>>>>>>> iptables -A FORWARD -i $INT_DEV -o $EXT_DEV -j ACCEPT
>>>>>>>>
>>>>>>>> ### INBOUND Rule: Allow ALL EXT packets if a connection
>>>>>>>>
>>>>>>> already
>>>>>>>
>>>>>>>
>>>>>> exists (See "NEW" Inbound Rules)
>>>>>>
>>>>>>>> iptables -A INPUT -i $EXT_DEV -m state --state
>>>>>>>>
>>>>>>> RELATED,ESTABLISHED
>>>>>>>
>>>>>>>
>>>>>> -j ACCEPT
>>>>>>
>>>>>>>> iptables -A FORWARD -i $EXT_DEV -m state --state
>>>>>>>>
>>>>>>> RELATED,ESTABLISHED
>>>>>>>
>>>>>>>
>>>>>> -j ACCEPT
>>>>>>
>>>>>>>> ### Squid Transparent Proxy
>>>>>>>> iptables -t nat -A PREROUTING -i eth0 -d iptables-box -p tcp
>>>>>>>>
>>>>>>> --dport
>>>>>>>
>>>>>>>
>>>>>> 80 -j ACCEPT
>>>>>>
>>>>>>>> iptables -t nat -A PREROUTING -i eth0 -s ! squid-box -p tcp
>>>>>>>>
>>>>>>> --dport
>>>>>>>
>>>>>>>
>>>>>> 80 -j DNAT --to squid-box:3128
>>>>>>
>>>>>>>> iptables -t nat -A POSTROUTING -o eth0 -s local-network -d
>>>>>>>>
>>>>>>> squid-box
>>>>>>>
>>>>>>>
>>>>>> -j SNAT --to iptables-box
>>>>>>
>>>>>>>> iptables -A FORWARD -s local-network -d squid-box -i eth0
>> -o
>>
> eth0
>>>>>>>>
>>>>>>> -p
>>>>>>>
>>>>>>>
>>>>>> tcp --dport 3128 -j ACCEPT
>>>>>>
>>>>>>>> and the result is:
>>>>>>>> - client's web browser ignore the squid proxy
>>>>>>>> the http service is directly passing through the firewall
>>>>>>>>
>>>>>>>> All response will greatly appreciated.
>>>>>>>>
>>>>>>>>
>>>>>>>> Thanks in advance (^^,)
>>>>>>>> Rachmat Hidayat Al Anshar
>>>>>>>>
>>>>>>>> Be a better friend, newshound, and
>>>>>>>> know-it-all with Yahoo! Mobile. Try it now.
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>
>
>> _______________________________________________________________________________
>>>>>>
>>>>>>> _____
>>>>>>>
>>>>>>>> Never miss a thing. Make Yahoo your home page.
>>>>>>>> http://www.yahoo.com/r/hs
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>
>>>>>>
>>>>>>
>>>>>>
>
>> _______________________________________________________________________________
>>>>> _____
>>>>>> Be a better friend, newshound, and
>>>>>> know-it-all with Yahoo! Mobile. Try it
>>>>> now.
>>>>>
>>>> http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ
>>>>>>
>>>>
>>>>
>>>>
>>>>
>>>
> _______________________________________________________________________________
>> _
>>>> ____
>>>> Never miss a thing. Make Yahoo your home page.
>>>> http://www.yahoo.com/r/hs
>>>>
>>>>
>>>
>>>
>>>
>>>
> _______________________________________________________________________________
>> _____
>>> Never miss a thing. Make Yahoo your home page.
>>> http://www.yahoo.com/r/hs
>>>
>>
>> --
>> Please use Squid 2.6STABLE17 or 3.0STABLE1.
>> There are serious security advisories out on all earlier releases.
>>
>>
>
>
>
>
> ____________________________________________________________________________________
> Be a better friend, newshound, and
> know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ
>
>

-- 
Please use Squid 2.6STABLE17 or 3.0STABLE1.
There are serious security advisories out on all earlier releases.