Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a squid proxy on my Debian-Gnu-Linux-laptop configured to block some web sites. I can set a browser to use this proxy, but I can also configure it to not use it. As I am using it to block some sites. I do not wish an application to be able to bypass the proxy. Is it possible to configure a fire wall to black outgoing traffic except if sent by the proxy application or user?

I would like a simple configurator if possible.

Note: I am using a single machine.

share|improve this question

You can run your squid proxy in one of two modes:

  1. Transparent mode: Send traffic transparently using a netfilter rule to squid. Forward all traffic destined to port 80. In this mode, you need to drop all traffic except http.
  2. Normal mode: The user has to configure the browser to use a proxy server. In this mode, you need to drop all traffic except http and destined to proxy server. In this case, the user will not be able to establish any http connection with any external web sever directly.

Don't forget to allow DNS traffic also (UDP/53).

If you allow other ports, someone may find some external proxy and use it to bypass your proxy.

share|improve this answer
if I redirect all traffic for port 80 etc to squid port will squid be able to get out or will there be a loop? Am I missing something. All the help I can find involves a separate machine. – richard Mar 27 '12 at 16:34

First set up squid, then make it run as user proxy (this was done by installer for me). Then:

sudo iptables -A OUTPUT -o lo -j ACCEPT # can access all local
sudo iptables -A OUTPUT -m owner --uid-owner proxy -j ACCEPT # proxy can do anything
sudo iptables -A OUTPUT -p udp --destination-port 53 -j ACCEPT #all can access dns, (could restrict more)
sudo iptables -A OUTPUT -j DROP #drop everything else

This is just policing, you still have to set up proxy in browser. Could probably add redirect rules as well.

I needed

sudo iptables -F OUTPUT

first to get rid of old rules

share|improve this answer
Is there a simple graphical tool that can help? Preferably to set up proxy and fire wall. – richard Mar 30 '12 at 8:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.