Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have installed squid as my proxy server in Ubuntu 10.04 standalone system which has a single NIC. Why i have installed Squid in a standalone system is because of my friends who uses my system to browse sites and download files. So I have installed Squid to block porn sites and downloads. But they simply bypass the proxy settings by disabling it in browser..I know there is some way to force all browsers to go through proxy using iptables. But how? I have searched everywhere for the answer but cant get the right one yet. Can somebody help me?

share|improve this question
up vote 2 down vote accepted

First block direct access to port 80 for all except root and squid. (root needs it to get updates for your system). (I'm assuming squid runs as user proxy - edit as appropriate).

iptables -A OUTPUT -m owner --uid-owner root -j ACCEPT
iptables -A OUTPUT -m owner --uid-owner proxy -j ACCEPT
iptables -A OUTPUT -p tcp --dport 80 -j DROP

Then you can set up firefox to use squid as a proxy as normal. If your friends change the settings then they will be blocked.

Note that squid can't proxy https traffic, so I haven't put those details in these rules. If you want to do only filtering with no proxying or caching, then you could use DansGuardian. This is a guide to using dansguardian with some users excluded from the filtering. The guide will mean that https (port 443) will be filtered by DansGuardian, as well as http (port 80).

share|improve this answer
No i din work yet,see my squid configuration, – karthick87 Nov 7 '10 at 19:36
see my squid configuration here – karthick87 Nov 7 '10 at 19:51
@karthick87: When you say it didn't work, do you mean that squid can't access the internet? I've just tried installing, and the user is actually proxy. I've updated my answer to reflect that. If it still doesn't work, please say what is not working. Also please post the output of sudo iptables -L -nvv aswell. – Hamish Downer Nov 7 '10 at 23:44
None of the websites are opening after using your iptable rule..Check out this link – karthick87 Nov 8 '10 at 5:44
@karthick87: your first rule has owner UID match 1000 at the end, but the UID of root is 0 normally. When I run the lines above, I get owner UID match 0. Try doing sudo wget to test the first rule. Anything done as sudo should be allowed out. Do iptables -F first to clear the old rules. – Hamish Downer Nov 8 '10 at 22:10

alternately you can drop LD_PRELOAD options for proxychains into .profile - if you want to proxy https you can do so with 3proxy

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.