RE: Shorewall and selective access

Tom Eastep
2004-12-19T19:38:05Z

On Sun, 2004-12-19 at 14:30 -0500, Greg Shepherd wrote:
> As I understand the Squid (transparent) Running on the Firewall:
>
> Squid (transparent) Running on the Firewall
> You want to redirect all local www connection requests EXCEPT those to your
> own http server (10.0.0.102) to a Squid transparent proxy running on the
> firewall and listening on port 3128. Squid will of course require access to
> remote web servers.
>
> In /etc/shorewall/rules:
>
> #ACTION   SOURCE     DEST     PROTO    DEST PORT(S)     SOURCE     ORIGINAL
> #                                                       PORT(S)    DEST
> REDIRECT  loc        3128     tcp      www              -
> !10.0.0.102
> ACCEPT    fw         net      tcp      www
>
> The firewall is running Apache. 10.0.0.102 is on the internal NIC. I wanted
> to redirect all www connection requests to 3128 except my own http server
on
> 10.0.0.102.
>
> Did I understand that right? IS the ! Required?

You understand correcly and yes, the "!" is
required.
>
> How is the rest of the configuration?
>
> I am getting "Destination host unreachable" when I ping
10.0.0.102 or public
> IP from 10.0.0.103 (in the ADM zone).
>
> No DNS resolving either from that IP.
>
> Does anyone have a working config of what I am attempting to do that I can
> learn from?

Please post the output of "shorewall status" as an attachment.