extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2025-01-03 03:59:16 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add instructions for proxying firewall-local connections

Browse Source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2010-05-01 08:26:22 -07:00
parent 518416ec2e
commit 5456c9fba3
1 changed files with 23 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
docs/Shorewall_Squid_Usage.xml
View File

@ -197,6 +197,29 @@ ACCEPT loc net tcp www</programlisting>
<para>The last rule may be omitted if your loc-&gt;net policy is
ACCEPT.</para>
<para>In some cases (when running an LTSP server on the Shorewall
system), you might want to transparently proxy web connections that
originate on the firewall itself. This requires care to ensure that
Squid's own web connections are not proxied.</para>
<para>First, determine the user id that Squid is running under:</para>
<programlisting>gateway:/etc/shorewall# <emphasis role="bold">ps aux | fgrep -i squid | fgrep -v fgrep</emphasis>
root 10085 0.0 0.0 23864 700 ? Ss Apr22 0:00 /usr/sbin/squid -D -YC
<emphasis role="bold">proxy</emphasis> 10088 0.0 0.9 40512 19192 ? S Apr22 10:58 <emphasis
role="bold">(squid)</emphasis> -D -YC
gateway:/etc/shorewall# </programlisting>
<para>In this case, the proxy process <emphasis
role="bold">(squid)</emphasis> is running under the <emphasis
role="bold">proxy</emphasis> user Id. We add these rules:</para>
<programlisting>#ACTION SOURCE DEST PROTO DEST PORT(S) SOURCE ORIGINAL RATE USER/
# PORT(S) DEST LIMIT GROUP
ACCEPT $FW net tcp www
REDIRECT $FW 3128 tcp www - - - <emphasis
role="bold"> !proxy</emphasis></programlisting>
</section>
<section id="Local">