RE: Shorewall and selective access

Greg Shepherd
2004-12-19T19:30:06Z

As I understand the Squid (transparent) Running on the Firewall:

Squid (transparent) Running on the Firewall
You want to redirect all local www connection requests EXCEPT those to your
own http server (10.0.0.102) to a Squid transparent proxy running on the
firewall and listening on port 3128. Squid will of course require access to
remote web servers.

In /etc/shorewall/rules:

#ACTION   SOURCE     DEST     PROTO    DEST PORT(S)     SOURCE     ORIGINAL
#                                                       PORT(S)    DEST
REDIRECT  loc        3128     tcp      www              -
!10.0.0.102
ACCEPT    fw         net      tcp      www

The firewall is running Apache. 10.0.0.102 is on the internal NIC. I wanted
to redirect all www connection requests to 3128 except my own http server on
10.0.0.102.

Did I understand that right? IS the ! Required?

How is the rest of the configuration?

I am getting "Destination host unreachable" when I ping 10.0.0.102 or
public
IP from 10.0.0.103 (in the ADM zone).

No DNS resolving either from that IP.

Does anyone have a working config of what I am attempting to do that I can
learn from?

Thanks

Greg


-----Original Message-----
From: Tom Eastep [mailto:teastep@shorewall.net]
Sent: Sunday, December 19, 2004 2:10 PM
To: Greg.Shepherd@netmanaged.com; Shorewall Users
Subject: Re: [Shorewall-users] Shorewall and selective access


One more thing:

On Sun, 2004-12-19 at 13:42 -0500, Greg Shepherd wrote:


> REDIRECT	loc	3128	tcp	www	-	10.0.0.102

I also don''t understand why you have 10.0.0.102 in the ORIGINAL DEST
column; that will only redirect connections to that IP address.