On 22 Jan 2010, at 04:30, Joseph wrote:
On 21 Jan 2010, at 23:52, Joseph wrote:
On 01/21/10 21:51, Stroller wrote:
maybe it is not possible with single interface eth0
I believe that running Squid in conjunction with iptables is
known as running in "interception" mode.
It may well indeed not be possible to do this with only one
interface. How do you ensure that packets reach this machine? I
think usually ... So I'm not really sure how the machines on your
LAN know to send web packets to your Squid machine. Perhaps you
can explain?
^ Could you answer these questions, please?
Simple, it is done by iptable in the kernel.
You are sending the packets to port 80 (http) to go out via eth0
that is the only way out, iptabls (your firewall) intercept the
traffic and does whatever you instruct it to do in my case below:
Intercept everything to 127.0.0.1 (localhost) and let it go no need
to forward it to squid, harmless traffic :-)
iptables -t nat -A OUTPUT -p tcp --dport 80 -d 127.0.0.1 -j ACCEPT
exempting squid, joseph, root from forwarding it to squid and
allowing Internet access without filtering; simple and self
explanatory
iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner --uid-owner
squid -j ACCEPT
iptables -t nat -A OUTPUT -p tcp --dport 3128 -m owner --uid-owner
squid -j ACCEPT
iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner --uid-owner
root -j ACCEPT
iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner --uid-owner
joseph -j ACCEPT
everything else passes through squid, which permits or allow the
traffic; in my case I only allow access to two domain, everything
thing else is denied (squid is redirecting the traffic to port 80
eth0 if permitted)
iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT --to-ports
3128
It is very simple.
So squid is run on the same PC that you're browsing from?
Yes, it is possible, it took me a day to figure it out as I'm not
a pro with iptables, check my post and follow the instructions:
http://forums.gentoo.org/viewtopic-p-6142685.html#6142685
I don't see the explanation in this link.
Stroller.
I don't understand what kind of explanation you expect, just emerge
squid iptable (make sure kernel has the correct entries compiled IN)
and type those commends in at the command line; read the post above
some other users clearly suggested what to type at the command
line :-)
It just works! I stated my objectives and I accomplished them.
Maybe I'm being very dumb. I assumed a situation of router A, with
Squid running on server B. The office staff are using browsers on
client machines X, Y & Z. When a user on machine X browses to a
website, his PC sends the packet to router A. The packet never reaches
server B in order to be intercepted by B. We can configure B as the
proxy in the browser settings of X, Y & Z, but then that no longer
needs iptables configuration or interception mode.
I'm not trying to argue with you, BTW. I'm just trying to learn from
you.
Stroller.
