0

I have a squid proxy on my Debian-Gnu-Linux-laptop configured to block some web sites. I can set a browser to use this proxy, but I can also configure it to not use it. As I am using it to block some sites. I do not wish an application to be able to bypass the proxy. Is it possible to configure a fire wall to black outgoing traffic except if sent by the proxy application or user?

I would like a simple configurator if possible.

Note: I am using a single machine.

2 Answers 2

0

You can run your squid proxy in one of two modes:

  1. Transparent mode: Send traffic transparently using a netfilter rule to squid. Forward all traffic destined to port 80. In this mode, you need to drop all traffic except http.
  2. Normal mode: The user has to configure the browser to use a proxy server. In this mode, you need to drop all traffic except http and destined to proxy server. In this case, the user will not be able to establish any http connection with any external web sever directly.

Don't forget to allow DNS traffic also (UDP/53).

If you allow other ports, someone may find some external proxy and use it to bypass your proxy.

1
  • if I redirect all traffic for port 80 etc to squid port will squid be able to get out or will there be a loop? Am I missing something. All the help I can find involves a separate machine. Mar 27, 2012 at 16:34
0

First set up squid, then make it run as user proxy (this was done by installer for me). Then:

sudo iptables -A OUTPUT -o lo -j ACCEPT # can access all local
sudo iptables -A OUTPUT -m owner --uid-owner proxy -j ACCEPT # proxy can do anything
sudo iptables -A OUTPUT -p udp --destination-port 53 -j ACCEPT #all can access dns, (could restrict more)
sudo iptables -A OUTPUT -j DROP #drop everything else

This is just policing, you still have to set up proxy in browser. Could probably add redirect rules as well.

I needed

sudo iptables -F OUTPUT

first to get rid of old rules

1
  • Is there a simple graphical tool that can help? Preferably to set up proxy and fire wall. Mar 30, 2012 at 8:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.