Re: Squid as default gateway in proxy mode.
On Sat, 14 Apr 2012 13:04:08 +0500
Muhammad Yousuf Khan <sirtcp@gmail.com> wrote:
> i have lately installed SQUID proxy and to avail all the facilities
> i am using it as Proxy mod not as Transparent mode neither i wanted
> to.
>
> now the problem part is i want to ping outside host to verify the
> connectivity of internet for that all the time i have to open the SSH
> the console and ping. but what i want is, i should also ping it from
> host computers as well. however i don't want to NAT all the traffic
> coming from inside and going outside. rather what i want is just to
> NAT only ICMP Echo Rep and Req so that i can at least ping outside
> host with out SSH the Squid console. which is very bothering.
> My network diagram is very simple
>
>
> <Squid
> Box>--------eth0(192.18.30.2)----------------------<192.168.30.1-ISP
> Router>
> I
> I
> eth1(192.168.1.1)
> I
> I
> (local network 192.168.1.0/24)
>
>
> And why i am using Squid as a Gateway because i just want to minimize
> unwanted nods that needs to be monitor all the time and batter
> control over traffic with IPtables firewall. i am using this line to
> NAT very specific ports to allow certain facilities like Email ,
> Remote desktop and stuff. and this is working for me.
>
> iptables -t nat -A POSTROUTING -p TCP --dport 110 -j MASQUERADE
>
> now i am stuck on allowing the ping traffic. please help
>
>
Instead of specifying the TCP protocol, you need to specify the ICMP
protocol, and just the specific types of ICMP that you want (only TCP
and UDP have 'ports'). But the right way to do it is to NAT everything
going out with one rule, and then use iptables rules with other targets
to allow only what you want to go in or out. You can build more complex
and versatile rulesets that way. More importantly, they are easier to
read and modify later.
By the way, squid is a proxy only for the http protocol, i.e. web
pages. It does not process anything else, and is just one application
on your machine.
This isn't a Debian-specific enquiry, and you might get more replies in
a more general Linux and/or firewall newsgroup, or a forum for any
specific management software you may be using.
--
Joe
Reply to: