Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am running a router (A Netgear WNDR3700 if that matters) with dd-wrt. For content filtering I am using OpenDNS. I wanted to make sure a user could not bypass OpenDNS by putting in their own name servers, so I have a rule to catch all DNS traffic.

iptables -t nat -A PREROUTING -i br0 -p all --dport 53 -j DNAT --to $LAN_IP

I did have one computer on the network I wanted to allow past OpenDNS filters. On that machine I manually set the name servers, and created another rule to allow it to pass

iptables -t nat -I PREROUTING -i br0 -s 192.168.1.2 -j ACCEPT

This worked well.

Today, I installed a transparent proxy (squid) on the router and added these rules:

iptables -t nat -A PREROUTING -i br0 -s $LAN_NET -d $LAN_NET -p tcp --dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -i br0 -s ! $PROXY_IP -p tcp --dport 80 -j DNAT --to $PROXY_IP:$PROXY_PORT
iptables -t nat -I POSTROUTING -o br0 -s $LAN_NET -d $PROXY_IP -p tcp -j SNAT --to $LAN_IP
iptables -I FORWARD -i br0 -o br0 -s $LAN_NET -d $PROXY_IP -p tcp --dport $PROXY_PORT -j ACCEPT

This also works, however the 192.168.1.2 address does not get routed through squid. How can I have 192.168.1.2 (and maybe others in the future) by-pass the port 53 rules, but not the port 80 rules?

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

Simply update this rule to make it more specific and only apply to DNS.

remove - iptables -t nat -I PREROUTING -i br0 -s 192.168.1.2 -j ACCEPT
add - iptables -t nat -I PREROUTING -i br0 -s 192.168.1.2 -p all --dport 53 -j ACCEPT
share|improve this answer
    
I tried that, but it isn't working for some reason. I'll update when I figure it out. –  SlimSCSI Sep 1 '11 at 17:52
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.