Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have squid running on a transparent proxy (port 3128) and VPN clients connecting + ip forwarding via PPTPD. I want to allow users to connect to port 80 (3128) but block all other TCP traffic.

I am currently using the following:

iptables -t nat -A PREROUTING -i ppp+ -p tcp --dport 80 -j REDIRECT --to-port 3128
iptables -t filter -A INPUT -i ppp+ -p tcp --dport 80 -j ACCEPT
iptables -t filter -A INPUT -i ppp+ -p tcp --dport 3128 -j ACCEPT
iptables -t filter -A INPUT -i ppp+ -p tcp -j DROP

Although I can see that the HTTP traffic is going through squid, I expect HTTPS (443) to be blocked but I can still load an HTTPS page when connected to the VPN.

Can you point me in the right direction of what is wrong here to block all NON HTTP TCP traffic from VPN clients?

Thanks

share|improve this question

1 Answer 1

I'm guessing maybe the filter table is not hit by VPN traffic. After changing it to FORWARD all works as expected

iptables -t nat -A PREROUTING -i ppp+ -p tcp --dport 80 -j REDIRECT --to-port 3128
iptables -A FORWARD -i ppp+ -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -i ppp+ -p tcp --dport 3128 -j ACCEPT
iptables -A FORWARD -i ppp+ -j DROP
iptables -A FORWARD -o ppp+ -j DROP
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.