Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Debian Squeeze VPS configured as an nginx web server. For security reasons I have blocked all outgoing connections except those to the Debian update servers (this stops bad scripts from calling home). PHP runs under a separate user as well. My problem is the following:

Various CMS-s and PHP/Perl/Python applications need to access web services on other servers (i.e. make outgoing HTTP connections). I have installed squid on that same VPS and want to use it as a transparent filter/proxy, by whitelisting the allowed domains.

I know how to force all outgoing port 80 connections through the proxy, but this would cause the proxy's own requests to be redirected to itself (i.e. infinite loop). I also can't use the ipt_owner module for iptables, as the VPS company unambiguously told me they are not going to install it.

Is there another clever way to force all other HTTP outgoing requests through the squid proxy on that same machine, while allowing the proxy's own requests out?

If it helps, I also have csf installed.

Thanks!

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

Ok, answering my own question:

Squid allows you to set the TOS on its outgoing packets. The setting is tcp_outgoing_tos . So, make an acl with the permitted IPs or domains and set, for example, tcp_outgoing_tos 0x10 whitelist

The packets from other applications usually have TOS 0x0.

Now follow the steps at squid's own tutorial http://wiki.squid-cache.org/ConfigExamples/Intercept/LinuxLocalhost#iptables_configuration, but instead of matching the packet's owner, we match the TOS.

# handle connections on the same box (SQUIDIP is a loopback instance)
iptables -t nat -A OUTPUT -p tcp --dport 80 -m tos --tos 0x10 -j ACCEPT
iptables -t nat -A OUTPUT -p tcp --dport 80 -j DNAT --to-destination SQUIDIP:3127

When using csf we may need to also accept these packets on the OUTPUT chain of the filter table. Put the rule at the beginning of the chain.

iptables -I OUTPUT -p tcp --dport 80 -m tos --tos 0x10 -j ACCEPT
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.