I have a computer that serves as:

a) a gateway between a wireless network (WLAN0) and a LAN (ETH0) connected to internet

b) a Squid3 proxy server that does only web filtering (no caching)

I have set up iptables like this:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT

When I configure a client on the WLAN to access internet via the proxy, it works just fine according to the rules specified in Squid.

However, internet is still accessible for WLAN clients that are not configured to use the proxy. Now I want to force these WLAN clients to use the proxy by setting up the correct rule within iptables to reject WLAN traffic that doesn't come from the proxy.

I have tried the following:

iptables -A INPUT -i wlan0 -p tcp --dport 3128 -j ACCEPT
iptables -A INPUT -i wlan0 -j DROP

but it does not work to block these WLAN clients that do no use the proxy.

Since the gateway and the proxy are on the same computer, I am confused about which iptables chain I should use to block these clients. Should I use INPUT (how?) or should I do it differently?


I think you should put the rule in forward chin not in input chin since the request destination not the server but another server ip

  • Thanks! You are right that the dport filtering should be in the FORWARD chain. Actually, I also needed to add a FORWARD rule to DROP all packets that don't match the first 2 rules, otherwise it could not block traffic. Now it works. – user3649004 Jun 3 '15 at 9:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.