Re: [gentoo-user] [SOLVED] squid - allowing only one domain

[Stroller]

On 22 Jan 2010, at 04:30, Joseph wrote:
>> On 21 Jan 2010, at 23:52, Joseph wrote:
>>> On 01/21/10 21:51, Stroller wrote:
>>>>> maybe it is not possible with single interface eth0
>>>>
>>>> I believe that running Squid in conjunction with iptables is
>>>> known as running in "interception" mode.
>>>>
>>>> It may well indeed not be possible to do this with only one
>>>> interface. How do you ensure that packets reach this machine? I
>>>> think usually ... So I'm not really sure how the machines on your
>>>> LAN know to send web packets to your Squid machine. Perhaps you
>>>> can explain?
>>
>> ^ Could you answer these questions, please?
>
> Simple, it is done by iptable in the kernel.
> You are sending the packets to port 80 (http) to go out via eth0
> that is the only way out, iptabls (your firewall) intercept the
> traffic and does whatever you instruct it to do in my case below:
>
> Intercept everything to 127.0.0.1 (localhost) and let it go no need
> to forward it to squid, harmless traffic :-)
> iptables -t nat -A OUTPUT -p tcp --dport 80 -d 127.0.0.1 -j ACCEPT
>
> exempting squid, joseph, root from forwarding it to squid and
> allowing Internet access without filtering; simple and self
> explanatory
> iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner --uid-owner
> squid -j ACCEPT
> iptables -t nat -A OUTPUT -p tcp --dport 3128 -m owner --uid-owner
> squid -j ACCEPT
> iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner --uid-owner
> root -j ACCEPT
> iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner --uid-owner
> joseph -j ACCEPT
>
> everything else passes through squid, which permits or allow the
> traffic; in my case I only allow access to two domain, everything
> thing else is denied (squid is redirecting the traffic to port 80
> eth0 if permitted)
> iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT --to-ports
> 3128
>
> It is very simple.

So squid is run on the same PC that you're browsing from?

>>> Yes, it is possible, it took me a day to figure it out as I'm not
>>> a pro with iptables, check my post and follow the instructions:
>>> http://forums.gentoo.org/viewtopic-p-6142685.html#6142685
>>
>> I don't see the explanation in this link.
>>
>> Stroller.
>
> I don't understand what kind of explanation you expect, just emerge
> squid iptable (make sure kernel has the correct entries compiled IN)
> and type those commends in at the command line; read the post above
> some other users clearly suggested what to type at the command
> line :-)
>
> It just works! I stated my objectives and I accomplished them.

Maybe I'm being very dumb. I assumed a situation of router A, with  
Squid running on server B. The office staff are using browsers on  
client machines X, Y & Z. When a user on machine X browses to a  
website, his PC sends the packet to router A. The packet never reaches  
server B in order to be intercepted by B. We can configure B as the  
proxy in the browser settings of X, Y & Z, but then that no longer  
needs iptables configuration or interception mode.

I'm not trying to argue with you, BTW. I'm just trying to learn from  
you.

Stroller.