Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm using squid3 (on ubuntu 10.10) and it manage connection completelly fine.

But how can I secure the traffic by setting the firewall on the *same serve*r?

If I use firewalls like ufw or firestarter, I'm not able to allow the squid port.

So I've tried to add some rules to iptables.up.rules, e.g.

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128
iptables -A INPUT -j ACCEPT -m state --state NEW,ESTABLISHED,RELATED -i eth1 -p tcp --dport 3128
iptables -A OUTPUT -j ACCEPT -m state --state NEW,ESTABLISHED,RELATED -o eth0 -p tcp --dport 80
iptables -A INPUT -j ACCEPT -m state --state ESTABLISHED,RELATED -i eth0 -p tcp --sport 80
iptables -A OUTPUT -j ACCEPT -m state --state ESTABLISHED,RELATED -o eth1 -p tcp --sport 80

Connection works, but I think iptables doesn't. How to make iptables to deny all the traffic and allow choosed ports only?

share|improve this question

1 Answer 1

You should set your INPUT policy to DENY, so all traffic that does not explicitly match one of the above rules is rejected.

I would also consider dropping the OUTPUT rules, since these add no extra security.

share|improve this answer
    
Thanks.. something like this? -A INPUT -j REJECT; -A FORWARD -j REJECT –  gaffcz Mar 20 '12 at 14:09
    
And the second thing - it tells me, there is some problem with -t parameter in first line (Line 24 seems to have a -t table option). Dont you know where could be an error? –  gaffcz Mar 20 '12 at 14:15
    
That does not change the POLICY on those chains. –  adaptr Mar 20 '12 at 14:41
    
Aha, -P INPUT (OUTPUT, FORWARD) DROP –  gaffcz Mar 21 '12 at 13:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.