iptables secure squid proxy

Question

I have a setup where my incoming internet connection feeds into a squid proxy/caching server, and from there into my local wireless router.

On the wan side of the proxy server, I have eth0 with address 208.78.∗∗∗.∗∗∗
On the lan side of the proxy server, I have eth1 with address 192.168.2.1

Traffic from my lan gets forwarded through the proxy transparently to the internet via the following rules. Note that traffic from the squid server itself is also routed through the proxy/cache, and this is on purpose:

# iptables forwarding
iptables -A FORWARD -i eth1 -o eth0 -s 192.168.2.0/24 -m state --state NEW -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A POSTROUTING -t nat -j MASQUERADE

# iptables for squid transparent proxy
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to 192.168.2.1:3128
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128

How can I set up iptables to block any connections made to my server from the outside, while not blocking anything initiated from the inside? I have tried doing:

iptables -A INPUT -i eth0 -s 192.168.2.0/24 -j ACCEPT
iptables -A INPUT -i eth0 -j REJECT

But this blocks everything. I have also tried reversing the order of those commands in case I got that part wrong, but that didn't help. I guess I don't fully understand everything about iptables.

Any ideas?

Answer 1

How can I set up iptables to block any connections made to my server from the outside, while not blocking anything initiated from the inside?

Put this in order at INPUT chain

iptables -A INPUT -i eth1 -j ACCEPT
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth0 -m state --state INVALID -j DROP
iptables -A INPUT -i eth0 -j REJECT

If you want to debug it, see your conntrack.

Answer 2

Depending on your iptables configuration, the first line may not be necessary, and the second line is definitely wrong (p.s is the second line eth0 or eth1).

The first line essentially allows your iptables to accept all incoming requests and connections from your internal network.

Try using this for the second line :

iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT

This tells iptables to forward all packets coming in from eth1 (WAN) to eth0 (LAN) - that way no connections can be made from eth1 (WAN) to your server.

Just a word of caution though : a two-liner iptables rules is asking for trouble. I suggest you find out more about how to configure by looking at sample configurations found online. You can start looking at this article.

Answer 3

I think maybe I have the answer. This seems to be working for me, and if anyone knows more checks to do than I did, please let me know.

I think I just needed to be sure to match the state of the connection. I added the following rules:

iptables -A INPUT -i eth0 -p icmp --icmp-type 8 -j DROP
iptables -A INPUT -i eth0 -s 192.168.2.0/24 -j ACCEPT
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth0 -j REJECT

I checked it by running nmap against the wan IP from a computer outside our network (my computer at home)...it just hung and never displayed anything.

I also attempted to connect to ports that are listening on the squid server, and all connection attempts failed. Everything still works as desired from within the network, however.

Answer 4

First of all, what is your policy for each chain? You can check with iptables -L The Policy is the default action that will be performed if no rule matches.

For the server protection what you need is this:

• Set the default rule to DROP

  iptables -P INPUT DROP

• Allow traffic from your LAN that is entering the LAN interface

  iptables -A INPUT -i eth1 -s 192.168.2.0/24 -j ACCEPT

and leave your FORWARD chain as is.

That's it.