0

I'm using squid3 (on ubuntu 10.10) and it manage connection completelly fine.

But how can I secure the traffic by setting the firewall on the same server?

If I use firewalls like ufw or firestarter, I'm not able to allow the squid port.

So I've tried to add some rules to iptables.up.rules, e.g.

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128
iptables -A INPUT -j ACCEPT -m state --state NEW,ESTABLISHED,RELATED -i eth1 -p tcp --dport 3128
iptables -A OUTPUT -j ACCEPT -m state --state NEW,ESTABLISHED,RELATED -o eth0 -p tcp --dport 80
iptables -A INPUT -j ACCEPT -m state --state ESTABLISHED,RELATED -i eth0 -p tcp --sport 80
iptables -A OUTPUT -j ACCEPT -m state --state ESTABLISHED,RELATED -o eth1 -p tcp --sport 80

Connection works, but I think iptables doesn't. How to make iptables to deny all the traffic and allow choosed ports only?

2

You should set your INPUT policy to DENY, so all traffic that does not explicitly match one of the above rules is rejected.

I would also consider dropping the OUTPUT rules, since these add no extra security.

  • Thanks.. something like this? -A INPUT -j REJECT; -A FORWARD -j REJECT – gaffcz Mar 20 '12 at 14:09
  • And the second thing - it tells me, there is some problem with -t parameter in first line (Line 24 seems to have a -t table option). Dont you know where could be an error? – gaffcz Mar 20 '12 at 14:15
  • That does not change the POLICY on those chains. – adaptr Mar 20 '12 at 14:41
  • Aha, -P INPUT (OUTPUT, FORWARD) DROP – gaffcz Mar 21 '12 at 13:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.