0

My network: 192.168.0.1 server. (enp0s3 NAT, enp0s8 internal) 192.168.0.10-15 clients (enp0s3 internal).

I have a proxysquid for blocking websites,and so on.

My clients can navigate and browse any website if no proxy is set at firefox settings, if I set the proxy they can't reach any website but can ping 8.8.8.8

My iptables for the conection are:

EXTERNA="enp0s3"
INTERNA="enp0s8"

echo "1" > /proc/sys/net/ipv4/ip_forward

iptables -t filter -F
iptables -t nat -F

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# ALLOW TCP & UDP PROTOCOLS
iptables -t filter -A FORWARD -i $INTERNA -p tcp -m multiport --dports 53,80 -j ACCEPT
iptables -t filter -A FORWARD -i $INTERNA -p udp --dport 53 -j ACCEPT
iptables -t filter -A FORWARD -i $INTERNA -p tcp  --dport 443 -j ACCEPT
iptables -t filter -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# ALLOW NAT
iptables -t nat -A POSTROUTING -o $EXTERNA -j MASQUERADE

To force clients I've tried:

iptables -t nat -A PREROUTING -i $INTERNA -p tcp -m multiport --dports 80,443 -j REDIRECT --to-port 3128

And:

iptables -t nat -A PREROUTING -i $INTERNA -p tcp -m multiport --dports 80,443 -j DNAT--to-destination 192.168.0.1:3128

The second one (-j DNAT), worked fine while I was using an ACCEPT default policy, but now I need to set the default policy to DROP, and it's not working anymore.

Honestly I'm a novice using iptables, and maybe the solution is easier than I think, but I need some help, thanks you all.

Improve this question
0

When you redirect traffics to the host itself, the chain of concern in the filter table would be INPUT instead of FORWARD, so add the necessary ACCEPT rules to the former instead. Also the port of concern would be the new port as well:

iptables -t filter -A FORWARD -i $INTERNA -p udp --dport 53 -j ACCEPT
iptables -t filter -A FORWARD -i $INTERNA -p tcp --dport 53 -j ACCEPT
iptables -t filter -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A INPUT -i $INTERNA -p tcp --dport 3128 -j ACCEPT
iptables -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
Improve this answer
3
  • Hi @Tom Yan, I feel a bit confused, honestly. Could you send my any correction of my script with the rules you think are the best? I don't really know how to fix it, I'm sorry. – Christian Sosa Apr 21 '20 at 17:01
  • I already did. Just replace the whole # ALLOW TCP & UDP PROTOCOLS block with the code block I've given you. – Tom Yan Apr 22 '20 at 0:48
  • Thanks you so much Tom, It helped me a lot. – Christian Sosa Apr 23 '20 at 13:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.