Home / server / Questions / 371556
In Process
gaffcz
Asked: 2012-03-21 05:57:20 +0800 CST

SQUID proxy + iptables

  • 772

I'm using squid3 (on ubuntu 10.10) and it manage connection completelly fine.

But how can I secure the traffic by setting the firewall on the same server?

If I use firewalls like ufw or firestarter, I'm not able to allow the squid port.

So I've tried to add some rules to iptables.up.rules, e.g.

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128
iptables -A INPUT -j ACCEPT -m state --state NEW,ESTABLISHED,RELATED -i eth1 -p tcp --dport 3128
iptables -A OUTPUT -j ACCEPT -m state --state NEW,ESTABLISHED,RELATED -o eth0 -p tcp --dport 80
iptables -A INPUT -j ACCEPT -m state --state ESTABLISHED,RELATED -i eth0 -p tcp --sport 80
iptables -A OUTPUT -j ACCEPT -m state --state ESTABLISHED,RELATED -o eth1 -p tcp --sport 80

Connection works, but I think iptables doesn't. How to make iptables to deny all the traffic and allow choosed ports only?

firewall proxy squid iptables

1 Answers

  1. You should set your INPUT policy to DENY, so all traffic that does not explicitly match one of the above rules is rejected.

    I would also consider dropping the OUTPUT rules, since these add no extra security.

    • 2