| View previous topic :: View next topic |
| Author |
Message |
Eum-Spliffum
n00b
Joined: 07 Aug 2003
Posts: 47
|
 Posted: Tue Sep 16, 2003 12:37 am Post subject: Squid and IPTables... Together in harmony? |
 |
|
I was doing a little reading and decided to go with Squid to meet my new NATing needs. I wanted to open a few ports for this and for that.
My current IPTables consists of a single chain rule.
| Code: |
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
root@moses squid # iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABL
ISHED
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
|
I went through the default configuration for Squid and to the best of my knowledge I un/commented everything I needed to, then proceeded to the access control lists (acl) and specified what I needed open and what to do with it.
After I finished I saved--started Squid--restarted iptables--only to find that it did nothing?! I'm still somewhat of an amature with firewalls and I fell I need some assistance. Thanks.
_________________
--m0ses |
|
| Back to top |
|
 |
Eum-Spliffum
n00b
Joined: 07 Aug 2003
Posts: 47
|
| Posted: Tue Sep 16, 2003 12:47 am Post subject: |
|
|
In addition...
I noticed that in the gentoo docs, in the acl section this is entered:
acl purge method PURGE, instead of
acl CONNECT method CONNECT...
And, they're using port 3128 instead of 80 or 8080 for http_port...??
_________________
--m0ses |
|
| Back to top |
|
|
xedx
Tux's lil' helper
Joined: 23 May 2003
Posts: 93
|
| Posted: Tue Sep 16, 2003 3:48 am Post subject: |
|
|
port 3128 is a standard for proxy ports...
squid alone can block ports too...
_________________
--+//+ |
|
| Back to top |
|
|
Diorf
n00b
Joined: 05 Jun 2003
Posts: 52
Location: Paris
|
| Posted: Tue Sep 16, 2003 10:10 am Post subject: |
|
|
just a little comment: in your current firewall config it does nothing and accept all packets from all interfaces. It's because your default policy for iptables is set to ACCEPT for all tables (it's the default). If you just want connection that are ESTABLISHED or RELATED to be accepted from eth0 (and nothing from the others interfaces) you have to do:
| Code: | $ iptables -P INPUT DROP
$ iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT |
But it is very important that you accept all incoming traffic from lo (127.0.0.1) until it can cause your box to burn out in flames of hell (euh not that much but is very important). So just add :
| Code: | | $ iptables -A INPUT -i lo -j ACCEPT |
Hope this can help |
|
| Back to top |
|
|
Eum-Spliffum
n00b
Joined: 07 Aug 2003
Posts: 47
|
| Posted: Tue Sep 16, 2003 2:42 pm Post subject: |
|
|
If only that were true in this case.
I know that's what the rule says but--that isn't the case really...
My problem is, I need around a dozen or so ports to be open for specific applications and certain file-transfer protocols. When trying to use these ports, well I can't cuz they aren't open. 
I've search the forums and there isn't a real clean-cut-and-dry answer to solve this dilema. First and foremost, Squid and IPtables need to be ran concurrently correct? Okay, then with my current NAT rule for IPT I should be able to config. and run Squid however I like, but that appears not to be the case in my situation. I'm sure I forgot to do something, but I'm off to work. Any additional information would be gravy for me.
Thanks.
_________________
--m0ses |
|
| Back to top |
|
|
grimshaw
Tux's lil' helper
Joined: 07 Aug 2003
Posts: 101
Location: Greensboro, NC 27403, USA, Earth
|
| Posted: Tue Sep 16, 2003 7:24 pm Post subject: |
|
|
Did you get an error from squid?
Try this to make sure you don't have a squid acl issue:
telnet localhost 3128
GET http://www.gnu.org/ HTTP/1.0
<this should return a lot of web page stuff>
telnet yourrealipaddress 3128
GET http://www.gnu.org/ HTTP/1.0
<this should return a lot of web page stuff too>
Reply with comments on what happened.
- John
_________________
All that is necessary for the triumph of evil is that good men do nothing.
-- Edmund Burke (1729-1797) |
|
| Back to top |
|
|
|
Networking & Security
