{"id":1427,"date":"2011-02-03T13:08:01","date_gmt":"2011-02-03T13:08:01","guid":{"rendered":"http:\/\/wiki.freeiz.com\/?p=1427"},"modified":"2016-08-09T12:06:32","modified_gmt":"2016-08-09T12:06:32","slug":"linux-danaguardian-proxy-iptables","status":"publish","type":"post","link":"https:\/\/wiki-see.info\/wp\/2011\/02\/03\/linux-danaguardian-proxy-iptables\/","title":{"rendered":"Linux Danaguardian Proxy Iptables"},"content":{"rendered":"

Push traffic to Proxy Filter Dansguardian<\/span><\/strong> :<\/span><\/p>\n

PREROUTING Chain<\/span> :
\nthis will have all traffic destined for port tcp 80 to jump to unfiltered_web<\/strong> chain<\/em>.<\/span><\/p>\n

iptables -I<\/span>\u00a0PREROUTING<\/span> -p tcp -m tcp –dport 80 -j<\/span> unfiltered_web<\/span><\/span><\/p>\n

unfiltered_web<\/span><\/strong> chain entry\u00a0:<\/span><\/p>\n

iptables -I<\/span>\u00a0unfiltered_web<\/span> -d 83.166.168.43 -p tcp -m tcp –dport 80 -j<\/span> ACCEPT
\n<\/span>iptables -I<\/span>\u00a0unfiltered_web<\/span> -d 212.41.178.44 -p tcp -m tcp –dport 80 -j<\/span> ACCEPT
\n<\/span>iptables -I<\/span>\u00a0unfiltered_web<\/span> -s 172.16.2.49 -p tcp -m tcp –dport 80 -j<\/span> ACCEPT<\/span><\/span><\/p>\n

Once unfiltered traffic to bypass proxy dansguardian using unfiltered_web<\/span><\/strong> chain as above,
\nthe last entry is to poing it back to filtered_web chain<\/span><\/strong>,\u00a0 in order to have other ip addresses or
\nsubnets\u00a0HTTP traffic filtered using the filtered_we<\/span><\/strong>b<\/span> chain .<\/em> to have proxy filter HTTP traffic :<\/span><\/p>\n

This will cause\u00a0unfiltered_web<\/span><\/strong> to jump to filtered_web<\/span><\/strong> chain<\/span><\/p>\n

iptables -I <\/span>unfiltered_web<\/span>-j<\/span> filtered_web<\/span><\/span><\/p>\n

filtered_web<\/span><\/strong> chain entry<\/em> :<\/span><\/p>\n

This will cause filtered_web<\/span><\/strong> chain to push all HTTP traffic to dansguardian proxy server<\/span>
\non 172.16.150.248<\/strong> on tcp port 8080.<\/strong><\/span><\/em><\/p>\n

Tcp 80 will be DNAT<\/span> to\u00a0tcp port 8080\u00a0to destination address of 172.16.150.248<\/span>.<\/span><\/p>\n

iptables -I<\/span>\u00a0filtered_web<\/span> -p tcp -m tcp –dport 80 -j<\/span> DNAT<\/span> –to-destination<\/span> 172.16.150.248:8080<\/span><\/span><\/p>\n

In Brief Summary<\/span><\/strong> :<\/span><\/p>\n

iptables -I\u00a0PREROUTING<\/span> -p tcp -m tcp –dport 80 -j unfiltered_web<\/span>
\n!<\/span>
\n iptables -I<\/span> unfiltered_web<\/span><\/span> -j<\/span> filtered_web<\/span>
\n<\/span>(Make changes in this chain for unfiltered traffic as seen above<\/strong><\/em>)<\/span>
\n<\/span>!
\niptables -I\u00a0<\/span>filtered_web<\/span><\/span> -p tcp -m tcp –dport 80 -j<\/span> DNAT<\/span><\/span> –to-destination<\/span> 172.16.150.248:8080<\/span><\/span><\/p>\n

Additional Notes<\/span><\/strong> :<\/span><\/p>\n

For<\/span> <\/strong>HTTP<\/span><\/strong><\/span> external sites that need to bypass proxy due to<\/span> HTTPS authentication<\/span><\/strong>,
\n<\/span>These are the changes that need to be made within iptables :<\/span><\/p>\n

sudo iptables -t nat -I<\/span> PREROUTING<\/span><\/span> -s 172.16.0.0\/16 -d 83.166.168.51\/32 -p tcp -m tcp –dport 443 -j ACCEPT
\n!<\/span>
\nsudo iptables -I<\/span> FORWARD<\/span><\/span> 1<\/span>8 -s 172.16.0.0\/16 -d 83.166.168.51\/32 -p tcp -m tcp –dport 443 -j ACCEPT<\/span><\/p>\n

Quick Summary<\/span> :<\/span><\/p>\n

sudo iptables -t nat -I<\/span> PREROUTING<\/span>\u00a01 -i eth 0 -s 10.10.0.0\/16 -p tcp -m tcp –dport 80 -j<\/span> unfiltered_web
\n<\/span>!<\/span>
\nsudo iptables -t nat -I<\/span> unfiltered_web <\/span>1 -i eth0 -s 10.10.34.12\/32 -j<\/span> ACCEPT
\n<\/span>sudo iptables -t nat -I<\/span> unfiltered_web<\/span> 2 -i eth0\u00a0-j<\/span> filtered_web
\n<\/span>!<\/span>
\ns<\/span>udo iptables -t nat -I<\/span> filtered_web <\/span>1 -i eth0 -p tcp -m tcp –dport 80 -j<\/span> REDIRECT<\/span> –to-ports 8080<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Push traffic to Proxy Filter Dansguardian : PREROUTING Chain : this will have all traffic destined for port tcp 80 to jump to unfiltered_web chain. iptables -I\u00a0PREROUTING -p tcp -m tcp –dport 80 -j unfiltered_web unfiltered_web chain entry\u00a0: iptables -I\u00a0unfiltered_web -d 83.166.168.43 -p tcp -m tcp –dport 80 -j ACCEPT iptables -I\u00a0unfiltered_web -d 212.41.178.44 -p […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18,8],"tags":[230,567],"class_list":["post-1427","post","type-post","status-publish","format-standard","hentry","category-iptables-linux","category-linux","tag-dansguardian","tag-proxy-iptables"],"_links":{"self":[{"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/posts\/1427","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/comments?post=1427"}],"version-history":[{"count":1,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/posts\/1427\/revisions"}],"predecessor-version":[{"id":4900,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/posts\/1427\/revisions\/4900"}],"wp:attachment":[{"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/media?parent=1427"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/categories?post=1427"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/tags?post=1427"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}