Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an internal network inside my LAN. The clients are connected via router to the main LAN. In the main LAN there is a connection to internet.

I set up a proxy in the main LAN and connected the clients to that proxy (by the internet properties in Windows ) and it works fine.

The proxy is a SQUID type listening to port 3128.

The problem is that I want to block all other ports in the internal LAN except for the proxy port (3128). I want to force those clients to use the proxy in any case.

When I did that there is no Internet. I suspect there are more port/s I should open. I played with it and found out that it always change... there are port/s above 55200... I cant find it... I think its dynamic.

network scheme :

--internal lan -           -   clients                 
- clients     ---- router -- - primary lan   ---  internet
-----------  -              -  proxy server
share|improve this question
You need to tell us at least your firewall type (hardware/software) and its platform (Linux, Windows) if it is software. Also, what have you tried to do? – Khaled Sep 20 '12 at 10:34
The firewall in the internal router . This is a small simple router for home users . one can block ports in it . When its with no blocking , everything works fine . when i block all ports except of 3128 , there is no internet in the internal clients . i suspect there r some more port or ports i should open . – user128935 Sep 20 '12 at 11:34


You need at least port 53 (DNS) for UDP and TCP.

If you really need to force everyone through the proxy then you might consider putting the proxy directly between the Router and the WAN access in a transparent matter. Thereby you counteract the need to set up the proxy on every client and still have the proxy function AND no easy way to curcumvent the proxy either.

share|improve this answer
Thanks , but I asked which ports should be opened for the client can "surf" by the proxy . when all ports are open , it works fine . but i don't want that . I need to do that on particular group of clients that located in saperated lan . i can't touch in rules in the primary router that connected to internet . – user128935 Sep 20 '12 at 13:28
Okay I will rethink it a bit after looking through your schema. – Christopher Perrin Sep 20 '12 at 13:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.