Iptables – Outside to port 80 doesn’t work with IPTables with Squid

firewalliptablesroutersquid

I cannot acccess to port TCP 80 from outside of my LAN configured by IPtables and Squid.

These are my iptables rules:

# RESET
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X

# Pas de filtrage sur l'interface lo
iptables -A INPUT -i lo -j ACCEPT

# Debut des reles de firewall
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -m state --state NEW ! -i eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

# LAN VERS le NET
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT

# J'autorise le port 22, 80
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT

# J'autorise ICMP et IGMP
iptables -A INPUT -p icmp -j ACCEPT
iptables -A INPUT -p igmp -j ACCEPT

# NAT
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

# Squid3
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to 10.32.25.1:3128
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128

iptables -A FORWARD -i eth1 -o eth1 -j REJECT

This is the content of my squid3.conf

http_port 3128 transparent

# Attention si vous modifiez les valeurs de la ligne suivante : lancez squid3 -f /etc/squid3/squid.conf -z pour reconstruire le cache !
cache_dir ufs /var/spool/squid3 8192 512 512
cache_mem 512MB

# Les journaux
cache_access_log /var/log/squid3/access.log common
cache_log /var/log/squid3/cache.log
cache_store_log /var/log/squid3/store.log
cache_swap_log /var/log/squid3/cache_swap.log
emulate_httpd_log on

# Configuration minimum recommandee

# Bloquer
#acl youtube_domains dstdomain .youtube.com .googlevideo.com .ytimg.com
#http_access deny youtube_domains

acl all src all
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT

# Denition des reseseaux
acl network_home_010032025000 src 10.32.25.0/26

# Les acces ou non
http_access allow network_home_010032025000
http_access deny all

# On renseigne le nom de machine qui fait serveur
visible_hostname home

#   Hidden my domain
append_domain .home.da....

Everything work from the inside of the network. Squid is working and NAT is working perfectly.

However, when I want to access from the outside, it doesn't work for the port 80. I can login using SSH from the outside, but Squid give me an error when I try to access from the outside using port 80 (website). Squid tell me "Access denied" when I go to my IP from the outside.

Any help? Thanks.

eth0 LAN (10.32.25.0/26)

eth1 WAN Gateway (10.30.25.0/26) / (External IP 69...*)

Best Answer

After deeper research, I found out that I need to specify the source when I redirect the PREROUTING to port 80. Here's what I edited in IPTables configuration:

Replace this line

#iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128

...with this line

iptables -t nat -A PREROUTING -i eth1 -p tcp -s 10.32.25.0/26 --dport 80 -j REDIRECT --to-port 3128

I've added -s 10.32.25.0/26 so this rule apply only to my internal network.

Related Topic