Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using squid3 (on ubuntu 10.10) and it manage connection completelly fine.

But how can I secure the traffic by setting the firewall on the *same serve*r?

If I use firewalls like ufw or firestarter, I'm not able to allow the squid port.

So I've tried to add some rules to iptables.up.rules, e.g.

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128
iptables -A INPUT -j ACCEPT -m state --state NEW,ESTABLISHED,RELATED -i eth1 -p tcp --dport 3128
iptables -A OUTPUT -j ACCEPT -m state --state NEW,ESTABLISHED,RELATED -o eth0 -p tcp --dport 80
iptables -A INPUT -j ACCEPT -m state --state ESTABLISHED,RELATED -i eth0 -p tcp --sport 80
iptables -A OUTPUT -j ACCEPT -m state --state ESTABLISHED,RELATED -o eth1 -p tcp --sport 80

Connection works, but I think iptables doesn't. How to make iptables to deny all the traffic and allow choosed ports only?

share|improve this question

You should set your INPUT policy to DENY, so all traffic that does not explicitly match one of the above rules is rejected.

I would also consider dropping the OUTPUT rules, since these add no extra security.

share|improve this answer
Thanks.. something like this? -A INPUT -j REJECT; -A FORWARD -j REJECT – gaffcz Mar 20 '12 at 14:09
And the second thing - it tells me, there is some problem with -t parameter in first line (Line 24 seems to have a -t table option). Dont you know where could be an error? – gaffcz Mar 20 '12 at 14:15
That does not change the POLICY on those chains. – adaptr Mar 20 '12 at 14:41
Aha, -P INPUT (OUTPUT, FORWARD) DROP – gaffcz Mar 21 '12 at 13:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.