2003-01-14 21:22:15 +01:00
|
|
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
|
|
|
<html>
|
|
|
|
|
<head>
|
|
|
|
|
<title>Shorewall Squid Usage</title>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
2003-01-14 21:22:15 +01:00
|
|
|
<meta http-equiv="content-type"
|
|
|
|
|
content="text/html; charset=ISO-8859-1">
|
2003-07-19 17:07:31 +02:00
|
|
|
|
2003-01-14 21:22:15 +01:00
|
|
|
<meta name="author" content="Tom Eastep">
|
|
|
|
|
</head>
|
|
|
|
|
<body>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
2003-01-14 21:22:15 +01:00
|
|
|
<table cellpadding="0" cellspacing="0" border="0" width="100%"
|
2003-07-16 20:59:33 +02:00
|
|
|
bgcolor="#3366ff">
|
2003-07-19 17:07:31 +02:00
|
|
|
<tbody>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="middle" width="33%" bgcolor="#3366ff"><a
|
2003-01-14 21:22:15 +01:00
|
|
|
href="http://www.squid-cache.org/"><img src="images/squidnow.gif"
|
|
|
|
|
alt="" width="88" height="31" hspace="4">
|
2003-07-19 17:07:31 +02:00
|
|
|
</a><br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="middle" height="90" align="center"
|
|
|
|
|
width="34%">
|
2003-07-16 20:59:33 +02:00
|
|
|
<h1><font color="#ffffff"><b>Using Shorewall with Squid</b></font></h1>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
2003-07-16 20:59:33 +02:00
|
|
|
<h1> </h1>
|
2003-07-19 17:07:31 +02:00
|
|
|
</td>
|
|
|
|
|
<td valign="middle" height="90" width="33%"
|
2003-07-16 20:59:33 +02:00
|
|
|
align="right"><a href="http://www.squid-cache.org/"><img
|
|
|
|
|
src="images/cache_now.gif" alt="" width="100" height="31" hspace="4">
|
2003-07-19 17:07:31 +02:00
|
|
|
</a><br>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2003-01-14 21:22:15 +01:00
|
|
|
</table>
|
2003-07-19 17:07:31 +02:00
|
|
|
<br>
|
|
|
|
|
This page covers Shorewall configuration to use with <a
|
|
|
|
|
href="http://www.squid-cache.org/">Squid </a>running as a <u><b>Transparent
|
|
|
|
|
Proxy</b></u>. If you are running Shorewall 1.3, please see <a
|
2003-04-13 17:28:32 +02:00
|
|
|
href="1.3/Shorewall_Squid_Usage.html">this documentation</a>.<br>
|
2003-07-19 17:07:31 +02:00
|
|
|
<br>
|
|
|
|
|
<img border="0" src="images/j0213519.gif" width="60"
|
2003-04-13 17:28:32 +02:00
|
|
|
height="60" alt="Caution" align="middle">
|
2003-07-19 17:07:31 +02:00
|
|
|
Please observe the following general requirements:<br>
|
|
|
|
|
<br>
|
|
|
|
|
<b><img src="images/BD21298_3.gif" alt="" width="13"
|
2003-06-18 22:03:19 +02:00
|
|
|
height="13">
|
2003-07-19 17:07:31 +02:00
|
|
|
</b>In all cases, Squid should be configured
|
2003-07-16 20:59:33 +02:00
|
|
|
to run as a transparent proxy as described at <a
|
2003-01-14 21:22:15 +01:00
|
|
|
href="http://www.tldp.org/HOWTO/mini/TransparentProxy-4.html">http://www.tldp.org/HOWTO/mini/TransparentProxy-4.html</a>.<br>
|
2003-07-19 17:07:31 +02:00
|
|
|
<b><br>
|
|
|
|
|
</b><b><img src="images/BD21298_3.gif" alt="" width="13"
|
2003-02-21 23:22:19 +01:00
|
|
|
height="13">
|
2003-07-19 17:07:31 +02:00
|
|
|
</b>The following instructions mention the
|
|
|
|
|
files /etc/shorewall/start and /etc/shorewall/init -- if you don't have
|
2003-07-16 20:59:33 +02:00
|
|
|
those files, siimply create them.<br>
|
2003-07-19 17:07:31 +02:00
|
|
|
<br>
|
|
|
|
|
<b><img src="images/BD21298_3.gif" alt="" width="13"
|
2003-06-18 22:03:19 +02:00
|
|
|
height="13">
|
2003-07-19 17:07:31 +02:00
|
|
|
</b> When the Squid server is in the DMZ
|
|
|
|
|
zone or in the local zone, that zone must be defined ONLY by its interface
|
|
|
|
|
-- no /etc/shorewall/hosts file entries. That is because the packets
|
|
|
|
|
being routed to the Squid server still have their original destination
|
|
|
|
|
IP addresses.<br>
|
|
|
|
|
<br>
|
|
|
|
|
<b><img src="images/BD21298_3.gif" alt="" width="13"
|
2003-06-18 22:03:19 +02:00
|
|
|
height="13">
|
2003-07-19 17:07:31 +02:00
|
|
|
</b> You must have iptables installed on
|
2003-07-16 20:59:33 +02:00
|
|
|
your Squid server.<br>
|
2003-07-19 17:07:31 +02:00
|
|
|
<br>
|
|
|
|
|
<b><img src="images/BD21298_3.gif" alt="" width="13"
|
2003-06-18 22:03:19 +02:00
|
|
|
height="13">
|
2003-07-19 17:07:31 +02:00
|
|
|
</b> If you run a Shorewall version earlier
|
|
|
|
|
than 1.4.6, you must have NAT and MANGLE enabled in your /etc/shorewall/conf
|
|
|
|
|
file<br>
|
|
|
|
|
<br>
|
|
|
|
|
<b><font color="#009900">
|
|
|
|
|
NAT_ENABLED=Yes<br>
|
|
|
|
|
</font></b> <font
|
2003-02-21 23:22:19 +01:00
|
|
|
color="#009900"><b>MANGLE_ENABLED=Yes</b></font><br>
|
2003-07-19 17:07:31 +02:00
|
|
|
<br>
|
|
|
|
|
Three different configurations are covered:<br>
|
|
|
|
|
|
2003-01-14 21:22:15 +01:00
|
|
|
<ol>
|
2003-07-19 17:07:31 +02:00
|
|
|
<li><a href="Shorewall_Squid_Usage.html#Firewall">Squid running
|
2003-07-16 20:59:33 +02:00
|
|
|
on the Firewall.</a></li>
|
2003-07-19 17:07:31 +02:00
|
|
|
<li><a href="Shorewall_Squid_Usage.html#Local">Squid running
|
|
|
|
|
in the local network</a></li>
|
|
|
|
|
<li><a href="Shorewall_Squid_Usage.html#DMZ">Squid running
|
|
|
|
|
in the DMZ</a></li>
|
|
|
|
|
|
2003-01-14 21:22:15 +01:00
|
|
|
</ol>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
2003-01-14 21:22:15 +01:00
|
|
|
<h2><a name="Firewall"></a>Squid Running on the Firewall</h2>
|
2003-07-19 17:07:31 +02:00
|
|
|
You want to redirect all local www connection requests EXCEPT
|
|
|
|
|
those to your
|
|
|
|
|
own http server (206.124.146.177)
|
|
|
|
|
to a Squid
|
|
|
|
|
transparent proxy running on the firewall and listening on
|
|
|
|
|
port 3128. Squid will of course require access to remote web servers.<br>
|
|
|
|
|
<br>
|
|
|
|
|
In /etc/shorewall/rules:<br>
|
|
|
|
|
<br>
|
|
|
|
|
|
|
|
|
|
<blockquote>
|
2003-01-14 21:22:15 +01:00
|
|
|
<table border="1" cellpadding="2" style="border-collapse: collapse;">
|
2003-07-19 17:07:31 +02:00
|
|
|
<tbody>
|
|
|
|
|
<tr>
|
|
|
|
|
<td><b>ACTION</b></td>
|
|
|
|
|
<td><b>SOURCE</b></td>
|
|
|
|
|
<td><b>DEST</b></td>
|
|
|
|
|
<td><b> PROTO</b></td>
|
|
|
|
|
<td><b>DEST<br>
|
|
|
|
|
PORT(S)</b></td>
|
|
|
|
|
<td><b>SOURCE<br>
|
|
|
|
|
PORT(S)</b></td>
|
|
|
|
|
<td><b>ORIGINAL<br>
|
|
|
|
|
DEST</b></td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td>REDIRECT</td>
|
|
|
|
|
<td>loc</td>
|
|
|
|
|
<td>3128</td>
|
|
|
|
|
<td>tcp</td>
|
|
|
|
|
<td>www</td>
|
|
|
|
|
<td> -<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td>!206.124.146.177</td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td>ACCEPT</td>
|
|
|
|
|
<td>fw</td>
|
|
|
|
|
<td>net</td>
|
|
|
|
|
<td>tcp</td>
|
|
|
|
|
<td>www</td>
|
|
|
|
|
<td> <br>
|
|
|
|
|
</td>
|
|
|
|
|
<td> <br>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2003-01-14 21:22:15 +01:00
|
|
|
</table>
|
2003-07-19 17:07:31 +02:00
|
|
|
<br>
|
|
|
|
|
</blockquote>
|
|
|
|
|
There may be a requirement to exclude additional destination hosts
|
|
|
|
|
or networks from being redirected. For example, you might also want requests
|
|
|
|
|
destined for 130.252.100.0/24 to not be routed to Squid. In that case, you
|
|
|
|
|
must add a manual rule in /etc/shorewall/start:<br>
|
|
|
|
|
|
|
|
|
|
<blockquote>
|
2003-06-18 22:03:19 +02:00
|
|
|
<pre>run_iptables -t nat -I loc_dnat -p tcp --dport www -d 130.252.100.0/24 -j RETURN<br></pre>
|
2003-07-19 17:07:31 +02:00
|
|
|
</blockquote>
|
|
|
|
|
To exclude additional hosts or networks, just add additional similar
|
2003-07-16 20:59:33 +02:00
|
|
|
rules.<br>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
2003-01-14 21:22:15 +01:00
|
|
|
<h2><a name="Local"></a>Squid Running in the local network</h2>
|
2003-07-19 17:07:31 +02:00
|
|
|
You want to redirect all local www connection requests
|
|
|
|
|
to a Squid transparent
|
|
|
|
|
proxy running in your local zone at 192.168.1.3 and listening on
|
|
|
|
|
port 3128. Your local interface is eth1. There may also be a web server
|
|
|
|
|
running on 192.168.1.3. It is assumed that web access is already enabled
|
2003-07-16 20:59:33 +02:00
|
|
|
from the local zone to the internet.<br>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
|
|
|
<p><font color="#ff0000"><b>WARNING: </b></font>This setup may conflict with
|
|
|
|
|
other aspects of your gateway including but not limited to traffic
|
|
|
|
|
shaping and route redirection. For that reason, <b>I don't recommend
|
|
|
|
|
it</b>.<br>
|
|
|
|
|
</p>
|
|
|
|
|
|
2003-01-14 21:22:15 +01:00
|
|
|
<ul>
|
2003-07-19 17:07:31 +02:00
|
|
|
<li>On your firewall system, issue the following command<br>
|
|
|
|
|
</li>
|
|
|
|
|
|
2003-02-22 21:15:15 +01:00
|
|
|
</ul>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
|
|
|
<blockquote>
|
2003-01-14 21:22:15 +01:00
|
|
|
<pre><b><font color="#009900">echo 202 www.out >> /etc/iproute2/rt_tables</font></b><br></pre>
|
2003-07-19 17:07:31 +02:00
|
|
|
</blockquote>
|
|
|
|
|
|
2003-01-14 21:22:15 +01:00
|
|
|
<ul>
|
2003-07-19 17:07:31 +02:00
|
|
|
<li>In /etc/shorewall/init, put:<br>
|
|
|
|
|
</li>
|
|
|
|
|
|
2003-01-14 21:22:15 +01:00
|
|
|
</ul>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
|
|
|
<blockquote>
|
2003-01-14 21:22:15 +01:00
|
|
|
<pre><b><font color="#009900">if [ -z "`ip rule list | grep www.out`" ] ; then<br> ip rule add fwmark 202 table www.out<br> ip route add default via 192.168.1.3 dev eth1 table www.out<br> ip route flush cache<br> echo 0 > /proc/sys/net/ipv4/conf/eth1/send_redirects<br>fi<br></font></b></pre>
|
2003-07-19 17:07:31 +02:00
|
|
|
</blockquote>
|
|
|
|
|
|
2003-01-14 21:22:15 +01:00
|
|
|
<ul>
|
2003-07-19 17:07:31 +02:00
|
|
|
<li>If you are running Shorewall 1.4.1 or Shorewall 1.4.1a,
|
2003-07-16 20:59:33 +02:00
|
|
|
please upgrade to Shorewall 1.4.2 or later.<br>
|
2003-07-19 17:07:31 +02:00
|
|
|
<br>
|
|
|
|
|
</li>
|
|
|
|
|
<li>If you are running Shorewall 1.4.2 or later, then in /etc/shorewall/interfaces:<br>
|
|
|
|
|
<br>
|
|
|
|
|
|
2003-04-13 17:28:32 +02:00
|
|
|
<table cellpadding="2" cellspacing="0" border="1">
|
2003-07-19 17:07:31 +02:00
|
|
|
<tbody>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top">ZONE<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">INTERFACE<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">BROADCAST<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">OPTIONS<br>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top">loc<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">eth1<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">detect<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top"><b>routeback</b><br>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2003-04-13 17:28:32 +02:00
|
|
|
</table>
|
2003-07-19 17:07:31 +02:00
|
|
|
<br>
|
|
|
|
|
</li>
|
|
|
|
|
<li>In /etc/shorewall/rules:<br>
|
|
|
|
|
<br>
|
|
|
|
|
|
2003-01-14 21:22:15 +01:00
|
|
|
<table border="1" cellpadding="2" style="border-collapse: collapse;">
|
2003-07-19 17:07:31 +02:00
|
|
|
<tbody>
|
|
|
|
|
<tr>
|
|
|
|
|
<td><b>ACTION</b></td>
|
|
|
|
|
<td><b>SOURCE</b></td>
|
|
|
|
|
<td><b>DEST</b></td>
|
|
|
|
|
<td><b> PROTO</b></td>
|
|
|
|
|
<td><b>DEST<br>
|
|
|
|
|
PORT(S)</b></td>
|
|
|
|
|
<td><b>SOURCE<br>
|
|
|
|
|
PORT(S)</b></td>
|
|
|
|
|
<td><b>ORIGINAL<br>
|
|
|
|
|
DEST</b></td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td>ACCEPT<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td>loc</td>
|
|
|
|
|
<td>loc<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td>tcp</td>
|
|
|
|
|
<td>www</td>
|
|
|
|
|
<td> <br>
|
|
|
|
|
</td>
|
|
|
|
|
<td><br>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2003-01-14 21:22:15 +01:00
|
|
|
</table>
|
2003-07-19 17:07:31 +02:00
|
|
|
</li>
|
|
|
|
|
<br>
|
|
|
|
|
<li>Alternativfely, if you are running Shorewall 1.4.0 you can have
|
2003-07-16 20:59:33 +02:00
|
|
|
the following policy in place of the above rule:<br>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
2003-07-04 18:41:22 +02:00
|
|
|
<table cellpadding="2" cellspacing="0" border="1">
|
2003-07-19 17:07:31 +02:00
|
|
|
<tbody>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top"><b>SOURCE<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>DESTINATION<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>POLICY<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>LOG LEVEL<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
<td valign="top"><b>BURST PARAMETERS<br>
|
|
|
|
|
</b></td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top">loc<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">loc<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">ACCEPT<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top"><br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top"><br>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2003-01-14 21:22:15 +01:00
|
|
|
</table>
|
2003-07-19 17:07:31 +02:00
|
|
|
<br>
|
|
|
|
|
</li>
|
|
|
|
|
<li>In /etc/shorewall/start add:<br>
|
|
|
|
|
</li>
|
|
|
|
|
|
2003-01-14 21:22:15 +01:00
|
|
|
</ul>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
|
|
|
<blockquote>
|
2003-01-14 21:22:15 +01:00
|
|
|
<pre><font color="#009900"><b>iptables -t mangle -A PREROUTING -i eth1 -s ! 192.168.1.3 -p tcp --dport 80 -j MARK --set-mark 202</b></font><br></pre>
|
2003-07-19 17:07:31 +02:00
|
|
|
</blockquote>
|
|
|
|
|
|
2003-01-14 21:22:15 +01:00
|
|
|
<ul>
|
2003-07-19 17:07:31 +02:00
|
|
|
<li>On 192.168.1.3, arrange for the following command to
|
2003-07-16 20:59:33 +02:00
|
|
|
be executed after networking has come up<br>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
2003-01-14 21:22:15 +01:00
|
|
|
<pre><b><font color="#009900">iptables -t nat -A PREROUTING -i eth0 -d ! 192.168.1.3 -p tcp --dport 80 -j REDIRECT --to-ports 3128</font></b><br></pre>
|
2003-07-19 17:07:31 +02:00
|
|
|
</li>
|
|
|
|
|
|
2003-01-14 21:22:15 +01:00
|
|
|
</ul>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
|
|
|
<blockquote> If you are running RedHat on the server, you can simply execute
|
|
|
|
|
the following commands after you have typed the iptables command
|
|
|
|
|
above:<br>
|
|
|
|
|
</blockquote>
|
|
|
|
|
|
|
|
|
|
<blockquote>
|
2003-01-31 22:50:51 +01:00
|
|
|
<blockquote> </blockquote>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
2003-01-14 21:22:15 +01:00
|
|
|
<pre><font color="#009900"><b>iptables-save > /etc/sysconfig/iptables</b></font><font
|
2003-07-19 17:07:31 +02:00
|
|
|
color="#009900"><b><br>chkconfig --level 35 iptables on<br></b></font></pre>
|
|
|
|
|
</blockquote>
|
|
|
|
|
|
2003-01-14 21:22:15 +01:00
|
|
|
<blockquote> </blockquote>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
2003-01-14 21:22:15 +01:00
|
|
|
<h2><a name="DMZ"></a>Squid Running in the DMZ (This is what I do)</h2>
|
2003-07-19 17:07:31 +02:00
|
|
|
You have a single Linux system in your DMZ with IP address
|
|
|
|
|
192.0.2.177. You want to run both a web server and Squid on that system.
|
|
|
|
|
Your DMZ interface is eth1 and your local interface is eth2.<br>
|
|
|
|
|
|
2003-01-14 21:22:15 +01:00
|
|
|
<ul>
|
2003-07-19 17:07:31 +02:00
|
|
|
<li>On your firewall system, issue the following command<br>
|
|
|
|
|
</li>
|
|
|
|
|
|
2003-01-14 21:22:15 +01:00
|
|
|
</ul>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
|
|
|
<blockquote>
|
2003-01-14 21:22:15 +01:00
|
|
|
<pre><font color="#009900"><b>echo 202 www.out >> /etc/iproute2/rt_tables</b></font><br></pre>
|
2003-07-19 17:07:31 +02:00
|
|
|
</blockquote>
|
|
|
|
|
|
2003-01-14 21:22:15 +01:00
|
|
|
<ul>
|
2003-07-19 17:07:31 +02:00
|
|
|
<li>In /etc/shorewall/init, put:<br>
|
|
|
|
|
</li>
|
|
|
|
|
|
2003-01-14 21:22:15 +01:00
|
|
|
</ul>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
|
|
|
<blockquote>
|
2003-01-14 21:22:15 +01:00
|
|
|
<pre><font color="#009900"><b>if [ -z "`ip rule list | grep www.out`" ] ; then<br> ip rule add fwmark 202 table www.out<br> ip route add default via 192.0.2.177 dev eth1 table www.out<br> ip route flush cache<br>fi</b></font><br></pre>
|
2003-07-19 17:07:31 +02:00
|
|
|
</blockquote>
|
|
|
|
|
|
2003-01-14 21:22:15 +01:00
|
|
|
<ul>
|
2003-07-19 17:07:31 +02:00
|
|
|
<li> Do<b> one </b>of the following:<br>
|
|
|
|
|
<br>
|
|
|
|
|
A) In /etc/shorewall/start add<br>
|
|
|
|
|
</li>
|
|
|
|
|
|
2003-01-14 21:22:15 +01:00
|
|
|
</ul>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
|
|
|
<blockquote>
|
2003-02-22 21:15:15 +01:00
|
|
|
<pre><b><font color="#009900"> iptables -t mangle -A PREROUTING -i eth2 -p tcp --dport 80 -j MARK --set-mark 202</font></b><br></pre>
|
2003-07-19 17:07:31 +02:00
|
|
|
</blockquote>
|
|
|
|
|
|
|
|
|
|
<blockquote>B) Set MARK_IN_FORWARD_CHAIN=No in /etc/shorewall/shorewall.conf
|
|
|
|
|
and add the following entry in /etc/shorewall/tcrules:<br>
|
|
|
|
|
</blockquote>
|
|
|
|
|
|
|
|
|
|
<blockquote>
|
|
|
|
|
<blockquote>
|
2003-07-16 20:59:33 +02:00
|
|
|
<table cellpadding="2" border="1" cellspacing="0">
|
|
|
|
|
<tbody>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top">MARK<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">SOURCE<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">DESTINATION<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">PROTOCOL<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">PORT<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">CLIENT PORT<br>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
2003-07-19 17:07:31 +02:00
|
|
|
<td valign="top">202<br>
|
2003-07-16 20:59:33 +02:00
|
|
|
</td>
|
|
|
|
|
<td valign="top">eth2<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">0.0.0.0/0<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">tcp<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">80<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">-<br>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
|
|
|
</tbody>
|
2003-07-16 20:59:33 +02:00
|
|
|
</table>
|
|
|
|
|
</blockquote>
|
2003-07-19 17:07:31 +02:00
|
|
|
C) Run Shorewall 1.3.14 or later and add the following entry in
|
|
|
|
|
/etc/shorewall/tcrules:<br>
|
|
|
|
|
</blockquote>
|
|
|
|
|
|
|
|
|
|
<blockquote>
|
|
|
|
|
<blockquote>
|
|
|
|
|
<table cellpadding="2" border="1" cellspacing="0">
|
|
|
|
|
<tbody>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top">MARK<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">SOURCE<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">DESTINATION<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">PROTOCOL<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">PORT<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">CLIENT PORT<br>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top">202:P<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">eth2<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">0.0.0.0/0<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">tcp<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">80<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">-<br>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
</tbody>
|
|
|
|
|
</table>
|
|
|
|
|
</blockquote>
|
|
|
|
|
</blockquote>
|
|
|
|
|
|
2003-07-16 20:59:33 +02:00
|
|
|
<ul>
|
2003-07-19 17:07:31 +02:00
|
|
|
<li>In /etc/shorewall/rules, you will need:</li>
|
|
|
|
|
|
2003-07-16 20:59:33 +02:00
|
|
|
</ul>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
|
|
|
<blockquote>
|
2003-07-16 20:59:33 +02:00
|
|
|
<table cellpadding="2" border="1" cellspacing="0">
|
2003-07-19 17:07:31 +02:00
|
|
|
<tbody>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top">ACTION<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">SOURCE<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">DEST<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">PROTO<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">DEST<br>
|
|
|
|
|
PORT(S)<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">CLIENT<br>
|
|
|
|
|
PORT(2)<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">ORIGINAL<br>
|
|
|
|
|
DEST<br>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top">ACCEPT<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">loc<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">dmz<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">tcp<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">80<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top"><br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top"><br>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td valign="top">ACCEPT<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">dmz<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">net<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">tcp<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top">80<br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top"><br>
|
|
|
|
|
</td>
|
|
|
|
|
<td valign="top"><br>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
</tbody>
|
2003-07-16 20:59:33 +02:00
|
|
|
</table>
|
2003-07-19 17:07:31 +02:00
|
|
|
<br>
|
|
|
|
|
</blockquote>
|
|
|
|
|
|
2003-04-13 17:28:32 +02:00
|
|
|
<ul>
|
2003-07-19 17:07:31 +02:00
|
|
|
<li>On 192.0.2.177 (your Web/Squid server), arrange for
|
2003-07-16 20:59:33 +02:00
|
|
|
the following command to be executed after networking has come up<br>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
2003-01-31 22:50:51 +01:00
|
|
|
<pre><font color="#009900"><b>iptables -t nat -A PREROUTING -i eth0 -d ! 192.0.2.177 -p tcp --dport 80 -j REDIRECT --to-ports 3128</b></font><br></pre>
|
2003-07-19 17:07:31 +02:00
|
|
|
</li>
|
|
|
|
|
|
2003-01-31 22:50:51 +01:00
|
|
|
</ul>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
|
|
|
<blockquote> If you are running RedHat on the server, you can simply execute
|
|
|
|
|
the following commands after you have typed the iptables command
|
|
|
|
|
above:<br>
|
|
|
|
|
</blockquote>
|
|
|
|
|
|
|
|
|
|
<blockquote>
|
2003-01-31 22:50:51 +01:00
|
|
|
<blockquote> </blockquote>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
2003-01-14 21:22:15 +01:00
|
|
|
<pre><font color="#009900"><b>iptables-save > /etc/sysconfig/iptables</b></font><font
|
2003-07-19 17:07:31 +02:00
|
|
|
color="#009900"><b><br>chkconfig --level 35 iptables on<br></b></font></pre>
|
|
|
|
|
</blockquote>
|
|
|
|
|
|
2003-01-14 21:22:15 +01:00
|
|
|
<blockquote> </blockquote>
|
2003-07-19 17:07:31 +02:00
|
|
|
|
|
|
|
|
<p><font size="-1"> Updated 7/18/2003 - <a href="support.htm">Tom Eastep</a>
|
|
|
|
|
</font></p>
|
2003-04-13 17:28:32 +02:00
|
|
|
|
2003-07-19 17:07:31 +02:00
|
|
|
<a href="copyright.htm"><font size="2">Copyright</font>
|
|
|
|
|
© <font size="2">2003 Thomas M. Eastep.</font></a><br>
|
|
|
|
|
<br>
|
|
|
|
|
<br>
|
2003-07-16 20:59:33 +02:00
|
|
|
<br>
|
2003-01-14 21:22:15 +01:00
|
|
|
</body>
|
|
|
|
|
</html>
|
