Re: [gentoo-user] [SOLVED] squid - allowing only one domain

[Joseph]

On 01/22/10 03:49, Stroller wrote:
>Thanks for posting Joseph.
>
>I would love to understand this better.
>
>
>On 21 Jan 2010, at 23:52, Joseph wrote:
>>On 01/21/10 21:51, Stroller wrote:
>>>>maybe it is not possible with single interface eth0
>>>
>>>I believe that running Squid in conjunction with iptables is
>>>known as running in "interception" mode.
>>>
>>>It may well indeed not be possible to do this with only one
>>>interface. How do you ensure that packets reach this machine? I
>>>think usually ... So I'm not really sure how the machines on your
>>>LAN know to send web packets to your Squid machine. Perhaps you
>>>can explain?
>
>^ Could you answer these questions, please?

Simple, it is done by iptable in the kernel.
You are sending the packets to port 80 (http) to go out via eth0 that is the only way out, iptabls (your firewall) intercept the traffic and does whatever 
you instruct it to do in my case below:

Intercept everything to 127.0.0.1 (localhost) and let it go no need to forward it to squid, harmless traffic :-)
iptables -t nat -A OUTPUT -p tcp --dport 80 -d 127.0.0.1 -j ACCEPT

exempting squid, joseph, root from forwarding it to squid and allowing Internet access without filtering; simple and self explanatory
iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner --uid-owner squid -j ACCEPT
iptables -t nat -A OUTPUT -p tcp --dport 3128 -m owner --uid-owner squid -j ACCEPT
iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner --uid-owner root -j ACCEPT
iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner --uid-owner joseph -j ACCEPT

everything else passes through squid, which permits or allow the traffic; in my case I only allow access to two domain, everything thing else is denied (squid 
is redirecting the traffic to port 80 eth0 if permitted)
iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT --to-ports 3128

It is very simple.

>
>>Yes, it is possible, it took me a day to figure it out as I'm not a
>>pro with iptables, check my post and follow the instructions:
>>http://forums.gentoo.org/viewtopic-p-6142685.html#6142685
>
>I don't see the explanation in this link.
>
>Stroller.

I don't understand what kind of explanation you expect, just emerge squid iptable (make sure kernel has the correct entries compiled IN) and type those 
commends in at the command line; read the post above some other users clearly suggested what to type at the command line :-)

It just works! I stated my objectives and I accomplished them.

-- 
Joseph