Omar Castaneda Acosta wrote: > Setup iptables to DROP/REJECT everything from the internal interface > except -m state NEW,ESTABLISHED,RELATED on every service you want to > allow.
thanks Omar, i'm needing more details about how to exactly do it. I'm opening just few ports from eth0( NET_INT, my local network) to my eth1 firewall (my internet valid ip), like 25,53,80 and 3128 ports. I do something like this "iptables -A INPUT -p tcp -j ACCEPT -s 192.168.1.10/255.255.255.0 -i eth0 -d 192.168.1.154 --dport nn" but all traffic is made like this: Client: ------ from: 192.168.1.10:nn to: 192.168.1.154:3128 (my firewall, squid server) Server: ------- from: 192.168.1.154:3128 to: 0.0.0.0 (Internet) All client browsers is configurated to work with proxy on port 3128. How can i filter destination ports requests from clients machines to external internet with proxy intercepting this traffic on 3128 port??? Very Thanks again.. Ze Luis > > Hi, > > i have a network with squid authentication on port 3128 and acl's > controls. My users only surf with password authentication. > > I don't control access port with squid acl. All ports is free by squid. > > But, > > i need control wich ports each machine can access by iptables. Is it > possible? > > My idea is : > > - squid do not control ports, only url_path, urlpath_regex, time, > password. > > - iptables open and close ports (from internal mchines to internet) for > data from proxy and other (telnet, irc, ssh and all other) > > My question: > > - Is it possible. > > if yes: > > - what chain use? > - a example, plase ;-) > > if no: > > - what's betther way to do this > > > Thanks, thanks, thanks. > > Ze Luis
