Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Linux machine kernel 3.7.0 with Squid proxy server and a direct Internet connection. Browsers and Squid reside on the same machine. Is it possible to allow access to web only through Squid? Maybe use SELinux?

share|improve this question

migrated from Mar 16 '13 at 22:35

This question came from our site for information security professionals.

up vote 7 down vote accepted

You can use the owner module in iptables (-m owner --uid-owner $SQUID_UID) to setup allow rules for Squid and then deny other traffic.

share|improve this answer

Maybe something like this?

# Your debian machine (gateway)

# Your network

# Your squid machine

iptables -t mangle -A PREROUTING -s $LAN_IP_RANGE ! -d $LAN_IP_RANGE -p TCP --destination-port 80 -j MARK --set-mark 11                                     
iptables -t nat -A PREROUTING -m mark --mark 11 -p TCP -j DNAT --to-destination ${PROXY_IP}:${PROXY_PORT}                                                          
iptables -t nat -A POSTROUTING -m mark --mark 11 -p TCP -j SNAT --to-source $LAN_IP


share|improve this answer

Here is the code:

iptables -P INPUT DROP
iptables -P FORWARD DROP
#loopback interface
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A INPUT -p udp --sport 53 -j ACCEPT
#http,https traffic only through Squid - nobody user
iptables -A OUTPUT -p tcp -m multiport --dports 80,443 -m state -m owner --uid-owner nobody --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -m multiport --sports 80,443 -m state  --state ESTABLISHED -j ACCEPT
share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .