Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have RHEL 5.0 squid proxy in our office.

Our LAN is /24 n/w. proxy ip is /24 .

I want to share internet through proxy.

Most importantly:

  1. I want to give full access to two IPs and to access the internet
  2. All the users should have the proxy address in their browsers to get internet, without the proxy in the browser internet should be blocked.

Can someone help me with what to write in iptables?

share|improve this question

If you want to force certain IP ranges to go through a proxy, basically you want to block outgoing TCP traffic on port 80 (and 443 if you are doing HTTPS) that is originating from on your Internet-facing interface. That way, if they try to not use the proxy, the connections will fail.

You want to make sure you put three exceptions before that rule:

  • one for the proxy itself, traffic originating from should be allowed to originate traffic on TCP ports 80/443
  • two for the IP addresses you want to skip the proxy before that rule though.

Below is what you'd add to your iptables script, or commands you can execute directly. Three things to keep in mind:

  • You may need to look at your existing rules to be sure earlier rules aren't accepting traffic you'd rather block
  • This assumes your OUTPUT policy is DROP (i.e. traffic that isn't explicitly ACCEPTed is DROPped). If it is not, you need one more rule at the bottom to drop everything else that's originating from and trying to get out via TCP 80/443.
  • $OUT_IFACE is your Internet or upstream facing interface

# accepts all traffic outgoing on TCP 80/443 from

/sbin/iptables -A OUTPUT --protocol TCP --source --match -multi-port --destination-ports 80,443 --out-interface $OUT_IFACE --jump ACCEPT

# accepts all traffic outgoing on TCP 80/443 from

/sbin/iptables -A OUTPUT --protocol TCP --source --match -multi-port --destination-ports 80,443 --out-interface $OUT_IFACE --jump ACCEPT

# accepts all traffic outgoing on TCP 80/443 NOT going to /sbin/iptables -A OUTPUT --protocol TCP --source 0/0 --destination --match -multi-port --destination-ports 80,443 --out-interface $OUT_IFACE --jump ACCEPT

# assuming a policy of DROP everything not obeying the above rules shoud die. You could add a LOG target here to log any incidents.

As an aside, it's been awhile since I've played with Squid but I think it does have the capability to authenticate users and possibly apply different rulesets to such users (including no rules for certain users - I think you still get a Via: header injected in your HTTP streams that give away you are using a proxy though).

share|improve this answer
hi user thanks for the help. – shyzer khan md Apr 5 '13 at 11:56
suppose i have flushed the iptables , can u tell me what is the procedure from starting to configure iptables, keeping in mind that only traffic is allowed and all other (except and should be blocked from my LAN. and all users browsers should have proxy address to get internet failing to give proxy should not get internet. please help in this – shyzer khan md Apr 5 '13 at 12:02
I would attempt port forwarding with DNAT. All port 80 requests are forwarded to the proxy on whatever port you have configured. Then the clients can not escape the proxy. – cybernard Apr 7 '13 at 3:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.