I have a computer that serves as:
a) a gateway between a wireless network (WLAN0) and a LAN (ETH0) connected to internet
b) a Squid3 proxy server that does only web filtering (no caching)
I have set up iptables like this:
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE iptables -A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT
When I configure a client on the WLAN to access internet via the proxy, it works just fine according to the rules specified in Squid.
However, internet is still accessible for WLAN clients that are not configured to use the proxy. Now I want to force these WLAN clients to use the proxy by setting up the correct rule within iptables to reject WLAN traffic that doesn't come from the proxy.
I have tried the following:
iptables -A INPUT -i wlan0 -p tcp --dport 3128 -j ACCEPT iptables -A INPUT -i wlan0 -j DROP
but it does not work to block these WLAN clients that do no use the proxy.
Since the gateway and the proxy are on the same computer, I am confused about which iptables chain I should use to block these clients. Should I use INPUT (how?) or should I do it differently?