Monday, April 25, 2011

IPTABLES for transparent Squid

In this post I created an iptables script and I name the file as fw.sh 

here's the sample content:
#!/bin/bash
#
#iptables ko... by verzion

# init string
ipt="/sbin/iptables"
SQUID_SERVER="ip_addr of your squid server"
WAN="eth0"
LAN="eth1"
SQUID_PORT="3128"

# how to use:
# $ipt -F
# rather than...
# /sbin/iptables -F

# Flush all config
$ipt -t filter -F
$ipt -t nat -F

# Policy settings
$ipt -P INPUT ACCEPT
$ipt -P FORWARD DROP
$ipt -P OUTPUT DROP

# Enabling IP forwarding.
echo "1" > /proc/sys/net/ipv4/ip_forward

# no firewall for LAN
$ipt -A INPUT -i $LAN -p all -j ACCEPT
$ipt -A OUTPUT -o $LAN -p all -j ACCEPT

# Allow SSH. Uncomment if you wish to use SSH
$ipt -A INPUT -p tcp --dport 22 -j ACCEPT

# Allow ICMP. Zero (0) is for echo-reply. Eight (8) is for echo-request.
$ipt -A INPUT -p icmp --icmp-type 8 -j ACCEPT

# Allow internet connection to this PC.
$ipt -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# set this system as a router for Rest of LAN
$ipt --table nat --append POSTROUTING --out-interface eth1 -j MASQUERADE
$ipt --append FORWARD --in-interface $LAN -j ACCEPT
$ipt -t nat -A POSTROUTING -o eth1 -j MASQUERADE

# DNAT port 80 request comming from LAN systems to squid 3128 ($SQUID_PORT) aka transparent proxy
iptables -t nat -A PREROUTING -i $LAN -p tcp --dport 80 -j DNAT --to $SQUID_SERVER:$SQUID_PORT
# if it is same system
iptables -t nat -A PREROUTING -i $WAN -p tcp --dport 80 -j REDIRECT --to-port $SQUID_PORT

# save settings to iptables (uncomment either of the two lines below to save the firewall settings)
#$ipt -L
#iptables-save

=== End of file

then make the script executable
# chmod a+x fw.sh

then to execute the script
# ./fw,sh

This ends the IPTABLES to forward the port 80 (www) requests to 3128 (squid). Now to automatically set the client PC's to have their own network IP by using DHCP

There is an update for this post. see http://linuxverzion.blogspot.com/2013/09/update-for-my-iptables-for-transparent.html
Cheers!

No comments: