-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I cheated .. I added /usr/sbin/iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 to my DansGuardian script .. and then I make sure that Dans never starts before Squid is fully operational .. Gary B Jeff Shantz wrote:
Hello,
I am currently a Google Summer of Code student working on the YaST Education module. One of the elements I'm adding to the module is the ability to filter web connections at a per-group level using Dansguardian and Squid. It needs to be configured as a transparent proxy so that kids can't get around the filtering.
I have Dansguardian and Squid configured and working properly. I also have a few custom iptables rules that work just fine when SuSEfirewall2 is not enabled:
iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner --uid-owner squid -j ACCEPT iptables -t nat -A OUTPUT -p tcp --dport 3128 -m owner --uid-owner squid -j ACCEPT iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT --to-ports 8080
So, I redirect requests on port 80 to 8080 (Dansguardian's port, which then redirects to Squid on port 3128), and allow all requests made by Squid. The rules have to be in the OUTPUT chain since all requests are originating from the firewall itself (since most parents/teachers will not have an extra system lying around to use as a dedicated firewall). These rules works great when SuSEfirewall2 is disabled.
I tried adding these custom rules to the fw_custom_before_denyall() hook in /etc/sysconfig/scripts/SuSEfirewall2-custom and added the following line to /etc/sysconfig/SuSEfirewall2:
FW_CUSTOMRULES="/etc/sysconfig/scripts/SuSEfirewall2-custom"
When I enable the firewall, the rules do get loaded (I can see them by running iptables -t nat -nvL), but pages just load forever after turning on the firewall.
Is there anyone that might be able to assist with this problem? I have been stuck on it for days and well, it's a Google Summer of Code project, so you'd be helping me help the community. :)
Other relevant details such as my entire ruleset output by iptables-save are located at [1].
Thanks in advance.
Regards, Jeff Shantz
[1] http://forums.opensuse.org/network-internet/417523-transparent-proxy-using-s... -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEARECAAYFAkpSELIACgkQ5BLKxPqBKDXKMgCfUfllLb3hYi0ENHLHp5cSSC+1 +VoAn29T18Mik/X4rdcjG+WRH4kaqlIp =qUV2 -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse-security+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-security+help@opensuse.org