Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a Linux machine kernel 3.7.0 with Squid proxy server and a direct Internet connection. Browsers and Squid reside on the same machine. Is it possible to allow access to web only through Squid? Maybe use SELinux?

share|improve this question

migrated from security.stackexchange.com Mar 16 '13 at 22:35

This question came from our site for Information security professionals.

add comment

3 Answers

up vote 7 down vote accepted

You can use the owner module in iptables (-m owner --uid-owner $SQUID_UID) to setup allow rules for Squid and then deny other traffic.

share|improve this answer
add comment

Maybe something like this?

# Your debian machine (gateway)
LAN_IP="192.168.0.1"

# Your network
LAN_IP_RANGE="192.168.0.0/24"                                                               

# Your squid machine
PROXY_IP="192.168.0.254"                                                                   
PROXY_PORT="3128"

iptables -t mangle -A PREROUTING -s $LAN_IP_RANGE ! -d $LAN_IP_RANGE -p TCP --destination-port 80 -j MARK --set-mark 11                                     
iptables -t nat -A PREROUTING -m mark --mark 11 -p TCP -j DNAT --to-destination ${PROXY_IP}:${PROXY_PORT}                                                          
iptables -t nat -A POSTROUTING -m mark --mark 11 -p TCP -j SNAT --to-source $LAN_IP

Source

share|improve this answer
add comment

Here is the code:

iptables -P INPUT DROP
iptables -P FORWARD DROP
#loopback interface
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
#DNS
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A INPUT -p udp --sport 53 -j ACCEPT
#http,https traffic only through Squid - nobody user
iptables -A OUTPUT -p tcp -m multiport --dports 80,443 -m state -m owner --uid-owner nobody --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -m multiport --sports 80,443 -m state  --state ESTABLISHED -j ACCEPT
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.