Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

We have RHEL 5.0 squid proxy in our office.

Our LAN is 172.20.12.0 /24 n/w. proxy ip is 172.20.12.4 /24 .

I want to share internet through proxy.

Most importantly:

  1. I want to give full access to two IPs 172.20.12.8 and 172.20.12.9 to access the internet
  2. All the users should have the proxy address in their browsers to get internet, without the proxy in the browser internet should be blocked.

Can someone help me with what to write in iptables?

share|improve this question
add comment

1 Answer

If you want to force certain IP ranges to go through a proxy, basically you want to block outgoing TCP traffic on port 80 (and 443 if you are doing HTTPS) that is originating from 172.20.12.0/24 on your Internet-facing interface. That way, if they try to not use the proxy, the connections will fail.

You want to make sure you put three exceptions before that rule:

  • one for the proxy itself, traffic originating from 172.20.12.4 should be allowed to originate traffic on TCP ports 80/443
  • two for the IP addresses you want to skip the proxy before that rule though.

Below is what you'd add to your iptables script, or commands you can execute directly. Three things to keep in mind:

  • You may need to look at your existing rules to be sure earlier rules aren't accepting traffic you'd rather block
  • This assumes your OUTPUT policy is DROP (i.e. traffic that isn't explicitly ACCEPTed is DROPped). If it is not, you need one more rule at the bottom to drop everything else that's originating from 172.20.12.0/24 and trying to get out via TCP 80/443.
  • $OUT_IFACE is your Internet or upstream facing interface

# accepts all traffic outgoing on TCP 80/443 from 172.20.12.8

/sbin/iptables -A OUTPUT --protocol TCP --source 172.20.12.8/24 --match -multi-port --destination-ports 80,443 --out-interface $OUT_IFACE --jump ACCEPT

# accepts all traffic outgoing on TCP 80/443 from 172.20.12.9

/sbin/iptables -A OUTPUT --protocol TCP --source 172.20.12.9/24 --match -multi-port --destination-ports 80,443 --out-interface $OUT_IFACE --jump ACCEPT

# accepts all traffic outgoing on TCP 80/443 NOT going to 172.20.12.4 /sbin/iptables -A OUTPUT --protocol TCP --source 0/0 --destination 172.20.12.4 --match -multi-port --destination-ports 80,443 --out-interface $OUT_IFACE --jump ACCEPT

# assuming a policy of DROP everything not obeying the above rules shoud die. You could add a LOG target here to log any incidents.

As an aside, it's been awhile since I've played with Squid but I think it does have the capability to authenticate users and possibly apply different rulesets to such users (including no rules for certain users - I think you still get a Via: header injected in your HTTP streams that give away you are using a proxy though).

share|improve this answer
    
hi user thanks for the help. –  shyzer khan md Apr 5 '13 at 11:56
    
suppose i have flushed the iptables , can u tell me what is the procedure from starting to configure iptables, keeping in mind that only 172.20.12.4/24 traffic is allowed and all other (except 172.20.12.8 and 172.20.12.9) should be blocked from my LAN. and all users browsers should have proxy address to get internet failing to give proxy should not get internet. please help in this –  shyzer khan md Apr 5 '13 at 12:02
    
I would attempt port forwarding with DNAT. All port 80 requests are forwarded to the proxy on whatever port you have configured. Then the clients can not escape the proxy. –  cybernard Apr 7 '13 at 3:38
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.