[linux] Re: iptables & squid

[Juraj Variny]

Hej. A trebalo by to zmenit asi takto:
$IPTABLES -A INPUT -P DROP
$IPTABLES -A INPUT -i $INTIF -s ip_janka_hraska -m mac
 --mac-source xx:xx:xx:xx:xx:xx -j ACCEPT

... a popovolovat este co na serveri bezi. 

$IPTABLES -A FORWARD -P DROP
...

Ak ma byt vsetko ostatne zakazane tak ani NAT netreba.
A v kazdom pripade si pozri aspon HOWTO. Nevies ake su moje pohnutky a ci som 
vobec nejaky odbornik :->

Juraj

On Saturday 06 November 2004 22:44, miso wrote:
> No mam to takto:
>
> ###################################################
> # Forwarding Rules
>
> # Note: Logging must precede Accept/Forwarding
> $IPTABLES -A FORWARD -j LOG --log-prefix "Firewall Forwarding: "
>
> $IPTABLES -A FORWARD -i $EXTIF -o $INTIF -j ACCEPT #Allow all inbound
>
> # List of hosts allowed to access the Internet
> # identified by MAC and IP address
>
>
> ### janko_hrasko ###
> $IPTABLES -A FORWARD -i $INTIF -o $EXTIF -s ip_janka_hraska -m mac
> --mac-source xx:xx:xx:xx:xx:xx -j ACCEPT
> $IPTABLES -t nat -A mac-nat -i eth1 --match mac --mac-source
> xx:xx:xx:xx:xx:xx -j ACCEPT
>
>
> #echo "   Enabling SNAT (MASQUERADE) functionality on $EXTIF"
> $IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
>
>
> $IPTABLES -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT
> --to-port 3128
>
> echo 1 > /proc/sys/net/ipv4/ip_forward
>
> o tej zmne mac viem, ale co potom zabere viacej ;) ?
>
> Dik,
> miso
>
> -----Original Message-----
> From: linux-bounces na lists.linux.sk [mailto:linux-bounces na lists.linux.sk] On
> Behalf Of Juraj Variny
> Sent: Sunday, November 07, 2004 10:10 PM
> To: Vseobecna diskusia o Linuxe
> Subject: [linux] Re: iptables & squid
>
> Ak som dobre pochopil, obmedzenie MAC adries musis presunut do chainu INPUT
> v
> iptables. Teraz to asi mas v chaine FORWARD, alebo jako ;o)))
>
> BTW, MAC adresa sa da pod windowsami zmenit rovnako jednoducho ako IPcka...
>
> Juraj
>
> On Friday 05 November 2004 22:26, Michal Vojtech wrote:
> > Hi,
> >
> >
> >
> > Na serveri, cez ktory bezi internet na lokalke, mam firewall na ip & mac,
> > obmedzujuci internetovy pristup iba na spravne kombinacie ip a mac
> > adresy. Setko je ok, ale spojazdnil som transparent proxy (squid) a
> > nastal problem - obmedzenie na IP funguje stale (podla konfiguraku
> > squid), ale uz mi ignoruje mac adresy, teda ktokolvek si moze nastavit IP
> > registrovanej sietovky a dostane sa na internet. Zrejme dochadza v proxy
> > k zmene
>
> hlavicky
>
> > packetov na lokalne adresy, alebo jako, a teda sa prepustaju cez
> > firewall. Neda sa predradit iptables pred proxy - aby prve obmedzenie
> > bolo na iptables a az potom proxy, alebo nejakou konfiguraciou squida?
> >
> >
> >
> > Diky moc.
> >
> >
> >
> > miso
>
> _______________________________________________
> http://lists.linux.sk/listinfo/linux
> Prehladavanie archivu: http://search.lists.linux.sk
> Meta FAQ: http://faq.lists.linux.sk
>
>
> ----------
> * www.inMail.sk - Vasa emailova adresa na cely zivot ZDARMA
> * www.SlovakNET.sk - profesionalny webhosting, domena .SK ZADARMO
> * Zoner Media Explorer 6 - stiahnite si pomocnika pre digitalnu fotografiu
> (http://www.zoner.sk/zme6)
> * www.ZonerPress.sk  - pocitacova literatura, zameranie na webdesign a
> grafiku
>
>
>
> __________ NOD32 1.917 (20041106) Information __________
>
> This message was checked by NOD32 antivirus system.
> http://www.nod32.com
>
>
>
>
> ----------
> * www.inMail.sk - Vasa emailova adresa na cely zivot ZDARMA
> * www.SlovakNET.sk - profesionalny webhosting, domena .SK ZADARMO
> * Zoner Media Explorer 6 - stiahnite si pomocnika pre digitalnu fotografiu
> (http://www.zoner.sk/zme6) * www.ZonerPress.sk  - pocitacova literatura,
> zameranie na webdesign a grafiku
>
> _______________________________________________
> http://lists.linux.sk/listinfo/linux
> Prehladavanie archivu: http://search.lists.linux.sk
> Meta FAQ: http://faq.lists.linux.sk