0

I'm using squid3 (on ubuntu 10.10) and it manage connection completelly fine.

But how can I secure the traffic by setting the firewall on the same server?

If I use firewalls like ufw or firestarter, I'm not able to allow the squid port.

So I've tried to add some rules to iptables.up.rules, e.g.

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128
iptables -A INPUT -j ACCEPT -m state --state NEW,ESTABLISHED,RELATED -i eth1 -p tcp --dport 3128
iptables -A OUTPUT -j ACCEPT -m state --state NEW,ESTABLISHED,RELATED -o eth0 -p tcp --dport 80
iptables -A INPUT -j ACCEPT -m state --state ESTABLISHED,RELATED -i eth0 -p tcp --sport 80
iptables -A OUTPUT -j ACCEPT -m state --state ESTABLISHED,RELATED -o eth1 -p tcp --sport 80

Connection works, but I think iptables doesn't. How to make iptables to deny all the traffic and allow choosed ports only?

Improve this question

1 Answer 1

Reset to default
2

You should set your INPUT policy to DENY, so all traffic that does not explicitly match one of the above rules is rejected.

I would also consider dropping the OUTPUT rules, since these add no extra security.

Improve this answer
4
  • Thanks.. something like this? -A INPUT -j REJECT; -A FORWARD -j REJECT
    – gaffcz
    Mar 20, 2012 at 14:09
  • And the second thing - it tells me, there is some problem with -t parameter in first line (Line 24 seems to have a -t table option). Dont you know where could be an error?
    – gaffcz
    Mar 20, 2012 at 14:15
  • That does not change the POLICY on those chains.
    – adaptr
    Mar 20, 2012 at 14:41
  • Aha, -P INPUT (OUTPUT, FORWARD) DROP
    – gaffcz
    Mar 21, 2012 at 13:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .