0

I would like to limit the access of the Privoxy port to a selected IP range. Background: I'm using an IPSec-VPN which users get 10.0.0.0/8 addresses assigned and only those users should be able to use the proxy service and "foreign users" are blocked out.

I tried the following iptables rules:

    iptables -A INPUT -p tcp --dport 8118 -s 10.0.0.0/8 -j ACCEPT
    iptables -A INPUT -p tcp --dport 8118 -j DROP

Unfortunately iptables keeps blocking the VPN users with their 10.0.0.0/8 address.

I use these rules to route the VPN traffic to the internet:

iptables -A INPUT -p udp -m udp --dport 500 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 4500 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 1701 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.1.2.0/24 -o eth0 -j MASQUERADE
iptables -A FORWARD -s 10.1.2.0/24 -j ACCEPT

Does anyone have an idea how to make this work? Thanks!

P.S.: And yes, the Proxy and VPN work without these rules ;-)

Improve this question
3
  • is the Privoxy installed on the same vpn server ?
    – MohyedeenN
    Jan 3, 2014 at 20:06
  • Yes it is :)...
    – user204250
    Jan 3, 2014 at 20:42
  • Is it possible to get the functionality you need via the permit-access, deny-access and listen-address parameters within the privoxy config file? I'm guessing I'm missing something more basic here though.
    – airhuff
    Feb 1, 2017 at 23:00

2 Answers 2

Reset to default
0

Why not limit to a pertain interface:

iptables -A INPUT -p tcp --dport 8118 -i tun0 -j ACCEPT
iptables -A INPUT -p tcp --dport 8118 -j DROP
Improve this answer
1
  • Unfortunately this doesn't work either, but it is definitely more elegant to target the interface :) Requests are still blocked from VPN access. I use the following rules to route the VPN traffic to the internet: (see updated post above). Could it have something to do with those rules?
    – user204250
    Jan 3, 2014 at 18:19
0

try to use iptraf and monitor the interface to check what are the source ip and port that are used to access privoxy,

Most probably you are accessing it with different source ip range or single ip. you will be sure by using iptraf.

to download it:

apt-get install iptraf
Improve this answer

You must log in to answer this question.