[linux] Re: iptables & squid

[miso]

No mam to takto:

###################################################
# Forwarding Rules

# Note: Logging must precede Accept/Forwarding
$IPTABLES -A FORWARD -j LOG --log-prefix "Firewall Forwarding: "

$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -j ACCEPT #Allow all inbound

# List of hosts allowed to access the Internet
# identified by MAC and IP address


### janko_hrasko ###
$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -s ip_janka_hraska -m mac
--mac-source xx:xx:xx:xx:xx:xx -j ACCEPT
$IPTABLES -t nat -A mac-nat -i eth1 --match mac --mac-source
xx:xx:xx:xx:xx:xx -j ACCEPT


#echo "   Enabling SNAT (MASQUERADE) functionality on $EXTIF"
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE


$IPTABLES -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT
--to-port 3128

echo 1 > /proc/sys/net/ipv4/ip_forward

o tej zmne mac viem, ale co potom zabere viacej ;) ?

Dik, 
miso

-----Original Message-----
From: linux-bounces na lists.linux.sk [mailto:linux-bounces na lists.linux.sk] On
Behalf Of Juraj Variny
Sent: Sunday, November 07, 2004 10:10 PM
To: Vseobecna diskusia o Linuxe
Subject: [linux] Re: iptables & squid

Ak som dobre pochopil, obmedzenie MAC adries musis presunut do chainu INPUT
v 
iptables. Teraz to asi mas v chaine FORWARD, alebo jako ;o)))

BTW, MAC adresa sa da pod windowsami zmenit rovnako jednoducho ako IPcka...

Juraj

On Friday 05 November 2004 22:26, Michal Vojtech wrote:
> Hi,
>
>
>
> Na serveri, cez ktory bezi internet na lokalke, mam firewall na ip & mac,
> obmedzujuci internetovy pristup iba na spravne kombinacie ip a mac adresy.
> Setko je ok, ale spojazdnil som transparent proxy (squid) a nastal problem
> - obmedzenie na IP funguje stale (podla konfiguraku squid), ale uz mi
> ignoruje mac adresy, teda ktokolvek si moze nastavit IP registrovanej
> sietovky a dostane sa na internet. Zrejme dochadza v proxy k zmene
hlavicky
> packetov na lokalne adresy, alebo jako, a teda sa prepustaju cez firewall.
> Neda sa predradit iptables pred proxy - aby prve obmedzenie bolo na
> iptables a az potom proxy, alebo nejakou konfiguraciou squida?
>
>
>
> Diky moc.
>
>
>
> miso

_______________________________________________
http://lists.linux.sk/listinfo/linux
Prehladavanie archivu: http://search.lists.linux.sk
Meta FAQ: http://faq.lists.linux.sk


----------
* www.inMail.sk - Vasa emailova adresa na cely zivot ZDARMA
* www.SlovakNET.sk - profesionalny webhosting, domena .SK ZADARMO
* Zoner Media Explorer 6 - stiahnite si pomocnika pre digitalnu fotografiu
(http://www.zoner.sk/zme6) 
* www.ZonerPress.sk  - pocitacova literatura, zameranie na webdesign a
grafiku 



__________ NOD32 1.917 (20041106) Information __________

This message was checked by NOD32 antivirus system.
http://www.nod32.com




----------
* www.inMail.sk - Vasa emailova adresa na cely zivot ZDARMA
* www.SlovakNET.sk - profesionalny webhosting, domena .SK ZADARMO
* Zoner Media Explorer 6 - stiahnite si pomocnika pre digitalnu fotografiu (http://www.zoner.sk/zme6) 
* www.ZonerPress.sk  - pocitacova literatura, zameranie na webdesign a grafiku