On 01/22/10 03:49, Stroller wrote:
Thanks for posting Joseph.
I would love to understand this better.
On 21 Jan 2010, at 23:52, Joseph wrote:
On 01/21/10 21:51, Stroller wrote:
maybe it is not possible with single interface eth0
I believe that running Squid in conjunction with iptables is
known as running in "interception" mode.
It may well indeed not be possible to do this with only one
interface. How do you ensure that packets reach this machine? I
think usually ... So I'm not really sure how the machines on your
LAN know to send web packets to your Squid machine. Perhaps you
can explain?
^ Could you answer these questions, please?
Simple, it is done by iptable in the kernel.
You are sending the packets to port 80 (http) to go out via eth0 that is the only way out, iptabls (your firewall) intercept the traffic and does whatever
you instruct it to do in my case below:
Intercept everything to 127.0.0.1 (localhost) and let it go no need to forward
it to squid, harmless traffic :-)
iptables -t nat -A OUTPUT -p tcp --dport 80 -d 127.0.0.1 -j ACCEPT
exempting squid, joseph, root from forwarding it to squid and allowing Internet
access without filtering; simple and self explanatory
iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner --uid-owner squid -j ACCEPT
iptables -t nat -A OUTPUT -p tcp --dport 3128 -m owner --uid-owner squid -j
ACCEPT
iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner --uid-owner root -j ACCEPT
iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner --uid-owner joseph -j
ACCEPT
everything else passes through squid, which permits or allow the traffic; in my case I only allow access to two domain, everything thing else is denied (squid
is redirecting the traffic to port 80 eth0 if permitted)
iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT --to-ports 3128
It is very simple.
Yes, it is possible, it took me a day to figure it out as I'm not a
pro with iptables, check my post and follow the instructions:
http://forums.gentoo.org/viewtopic-p-6142685.html#6142685
I don't see the explanation in this link.
Stroller.
I don't understand what kind of explanation you expect, just emerge squid iptable (make sure kernel has the correct entries compiled IN) and type those
commends in at the command line; read the post above some other users clearly suggested what to type at the command line :-)
It just works! I stated my objectives and I accomplished them.
--
Joseph
