Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Ubuntu box with Squid installed acting as a transparent proxy server. The config which does the magic is the following. (eth0 is external interface and eth1 is internal.)

sudo sh -c 'echo 1 > /proc/sys/net/ipv4/ip_forward'
sudo iptables -t nat -A POSTROUTING --jump MASQUERADE --source
sudo iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128

At this point the proxy works fine.

Then i need to filter out some packets so I use ufw. i.e.

sudo ufw allow http
sudo ufw allow https
sudo ufw allow ssh
sudo deny 5223/tcp
sudo ufw enable

At this point nothing works anymore. Not sure what I am missing. Should i do anything with port 3128? Am I having issues because I have two interfaces? Trying the hardest to wrap my head around this but no luck.

share|improve this question
up vote 0 down vote accepted

I ended up using iptables directly instead of using ufw. Seems like ufw by default creates a catch-all which i didn't need in my case.

sudo iptables -A INPUT -j DROP -p tcp --destination-port 5223 -i eth1
share|improve this answer
Yes, if you're already at the point where you're working with iptables, it's best just to stay there. IMHO, ufw is a feeble attempt and doesn't work for anything that isn't a single-NIC box. – Magellan Mar 2 '12 at 20:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.