1

My goal is to be able to make a connection to one, and only one, website through a proxy. Everything else should be dropped.

I have been able to do this successfully without a proxy with this code:

./iptables -I INPUT 1 -i lo -j ACCEPT
./iptabels -A OUTPUT -p udp --dport 53 -j ACCEPT
./iptables -A OUTPUT -p tcp -d www.website.com --dport 80 -j ACCEPT
./iptables -A INPUT -m conntrack --cstate ESTABLISHED,RELATED -j ACCEPT
./iptables -P INPUT DROP
./iptables -P OUTPUT DROP

How could I do the same thing except redirect the traffic to port 8080 somewhere? I've been trying to redirect in the PREROUTING chain in the nat table. I'm unsure if this is the proper place to do that tho.

Thanks for your help!

0

2 Answers 2

1

I think the webserver configuration is better place to do this. Please check the virtual hosts configuration of the Apache server:

Apache vhosts configuration: http://httpd.apache.org/docs/2.2/vhosts/examples.html

Other servers have similar configuration. You can specify what websites (by URL) you want them to handle.

1

You don't need to drop the http traffic except the traffic destined to specific domain using iptables. You can redirect http traffic to your proxy using a rule like this:

iptables -t nat -A PREROUTING -p tcp --dport 80  -j DNAT --to-destination proxy_ip:8080

You need to have a running proxy server which supports transparent proxying and listening on port 8080. You can then configure your proxy to allow/deny whatever you want like domains/URLs, etc..

Please, note that using domain names in iptables rule is not a good idea as the changes in name-IP mapping will not be seen by iptables after entering the rules.

You must log in to answer this question.