squid & iptables help

[nightowl]

I want to only allow access to certain websites using either squid or iptables. I tried using IP tables to block all outgoing traffic and then allow outbound traffic to the sites I wanted to allow access to. This did not work. I think is is because the traffic is coming back on a different port that I have blocked. Is this correct or do I need to change anything?0 I am not blocking anything inbound yet. I can also use squid if necessary, but how would I block all sites and then allow certain sites in?

 

[Buddha Bart]

You could theoretically go either way, but what I think you want to do is this:

1.) block all outbound traffic not from the server (aka originating from your lan interface) with a destination port of 80
2.) configure squid to block all except a whitelist you've created.
3.) configure all browsers to use the proxy server

Theoretically they could setup their own proxy server on the outside and go through that instead, if you're that worried you've got a lot more things you have to factor in.

 

[cleverhandle]

The typical way to do this is with a content filter like Dan's Guardian that runs along with squid. IPTables is too low-level to filter sites in a reasonable manner. You can however, configure a firewall to redirect outbound port 80 requests through the squid proxy. That way, you don't have to configure anything on the clients - they make apparently normal web requests, which are transparently rerouted through the squid box.

 

[nightowl]

How would you redirect requests through squid with iptables or some equivalent?

 

[cleverhandle]

Googling on "transparent squid proxy" will give you lots of information.