I found today, that I have open proxy (squid on Debian). I fixed the firewall rule, and now I'm not. But someone still uses this proxy - it looks like it is proxying from inside my machine. I try to find which process is using my proxy.

I have Debian with lxc-containers. squid is in one container (, and I think, that process which is using my squid is on the host machine:

1520955127.112     43 TCP_MISS/200 585 GET http://766dsw.top/ - HIER_DIRECT/ text/html

How to get the process? (Maybe it isn't from inside?) I run the iptables -j LOG, and got this:

Mar 13 18:14:56 zenon kernel: FORWARD  IN=enp2s0 OUT=lxcbr0 MAC=00:19:b9:1c:83:c4:00:1d:aa:cf:bd:a0:08:00 SRC= DST= LEN=40 TOS=0x00 PREC=0x00 TTL=115 ID=14541 DF PROTO=TCP SPT=49875 DPT=8080 WINDOW=256 RES=0x00 ACK URGP=0

but I remove every rule of prerouting from firewall about 8080 port and address... and of course iptables -A FORWARD -P DROP

and somehow it still passes....

1 Answer 1


Finally found the problem - of course it was firewall.

I use droplist from this tutorial and put rules iptables -I FORWARD -j droplist somewhere in the middle of rules. But this rule has to be first rule


$IPT -F 
$IPT -F nat

$IPT -X droplist
$IPT -N droplist
egrep -v "^#|^$" $_input | while IFS= read -r ip
    $IPT -A droplist -i eth1 -s $ip -j LOG --log-prefix "IP BlockList "
    $IPT -A droplist -i eth1 -s $ip -j DROP

# Drop it
$IPT -I INPUT -j droplist
$IPT -I OUTPUT -j droplist
$IPT -I FORWARD -j droplist

and the rest of the rules

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .