Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

IPTables rules :

iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X

# Pas de filtrage sur l'interface lo
iptables -A INPUT -i lo -j ACCEPT

# Debut des reles de firewall
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -m state --state NEW ! -i eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT

# J'autorise le port 22, 80
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT

# J'autorise ICMP et IGMP
iptables -A INPUT -p icmp -j ACCEPT
iptables -A INPUT -p igmp -j ACCEPT

iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

# Squid3
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128

iptables -A FORWARD -i eth1 -o eth1 -j REJECT

Squid3 Conf

http_port 3128 transparent

# Attention si vous modifiez les valeurs de la ligne suivante : lancez squid3 -f /etc/squid3/squid.conf -z pour reconstruire le cache !
cache_dir ufs /var/spool/squid3 8192 512 512
cache_mem 512MB

# Les journaux
cache_access_log /var/log/squid3/access.log common
cache_log /var/log/squid3/cache.log
cache_store_log /var/log/squid3/store.log
cache_swap_log /var/log/squid3/cache_swap.log
emulate_httpd_log on

# Configuration minimum recommandee

# Bloquer
#acl youtube_domains dstdomain .youtube.com .googlevideo.com .ytimg.com
#http_access deny youtube_domains

acl all src all
acl manager proto cache_object
acl localhost src
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http

# Denition des reseseaux
acl network_home_010032025000 src

# Les acces ou non
http_access allow network_home_010032025000
http_access deny all

# On renseigne le nom de machine qui fait serveur
visible_hostname home

#   Hidden my domain
append_domain .home.da....

Everything work from the inside of the network. Squid is working and NAT is working perfectly. However, when I want to access from the outside, it doesn't work for the port 80. I can login using SSH from the outside, but Squid give me an error when I try to access from the outside using port 80 (website). Squid tell me "Access denied" when I go to my IP from the outside.

Any help ? Thanks.

eth0 LAN (

eth1 WAN Gateway ( / (External IP 69...*)

share|improve this question

1 Answer 1

After deeper research, I found out that I need to specify the source when I redirect the PREROUTING to port 80.

Here's what I edited in IPTables configuration :

Remove line

#iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128

With this line

iptables -t nat -A PREROUTING -i eth1 -p tcp -s --dport 80 -j REDIRECT --to-port 3128

I added -s so this rule apply only to my internal network.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.