Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I would like to limit the access of the Privoxy port to a selected IP range. Background: I'm using an IPSec-VPN which users get 10.0.0.0/8 addresses assigned and only those users should be able to use the proxy service and "foreign users" are blocked out.

I tried the following iptables rules:

    iptables -A INPUT -p tcp --dport 8118 -s 10.0.0.0/8 -j ACCEPT
    iptables -A INPUT -p tcp --dport 8118 -j DROP

Unfortunately iptables keeps blocking the VPN users with their 10.0.0.0/8 address.

I use these rules to route the VPN traffic to the internet:

iptables -A INPUT -p udp -m udp --dport 500 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 4500 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 1701 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.1.2.0/24 -o eth0 -j MASQUERADE
iptables -A FORWARD -s 10.1.2.0/24 -j ACCEPT

Does anyone have an idea how to make this work? Thanks!

P.S.: And yes, the Proxy and VPN work without these rules ;-)

share|improve this question
    
is the Privoxy installed on the same vpn server ? –  MohyedeenN Jan 3 at 20:06
    
Yes it is :)... –  blacktea Jan 3 at 20:42

2 Answers 2

Why not limit to a pertain interface:

iptables -A INPUT -p tcp --dport 8118 -i tun0 -j ACCEPT
iptables -A INPUT -p tcp --dport 8118 -j DROP
share|improve this answer
    
Unfortunately this doesn't work either, but it is definitely more elegant to target the interface :) Requests are still blocked from VPN access. I use the following rules to route the VPN traffic to the internet: (see updated post above). Could it have something to do with those rules? –  blacktea Jan 3 at 18:19

try to use iptraf and monitor the interface to check what are the source ip and port that are used to access privoxy,

Most probably you are accessing it with different source ip range or single ip. you will be sure by using iptraf.

to download it:

apt-get install iptraf
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.