1

I am running a LAMP stack on an Arch Linux server in my home, and my router firewall port 80 is open to the world.

Recently, I've decided to set up a dansguardian transparent proxy to do some web filtering for my children.

Everything is working well inside my LAN.

However, while checking the dansguardian logs, I noticed that my home had become a proxy for chinese IP addresses. Apparently, my iptables setup is allowing requests coming in on port 80 to be sent to my LAN dansguardian setup!

I have now closed down port 80, but I would like to continue running my home website. I need to setup iptables to transparently proxy LAN http requests through dansguardian but not proxy INCOMING requests on port 80.

Here is the output of iptables-save:

# Generated by iptables-save v1.4.18 on Tue May 20 18:51:46 2014
*filter
:INPUT ACCEPT [99752358:83925475634]
:FORWARD ACCEPT [1137723:181159087]
:OUTPUT ACCEPT [57478321:118350587619]
COMMIT
# Completed on Tue May 20 18:51:46 2014
# Generated by iptables-save v1.4.18 on Tue May 20 18:51:46 2014
*nat
:PREROUTING ACCEPT [3362634:253695591]
:INPUT ACCEPT [3450241:258605740]
:OUTPUT ACCEPT [3451732:250709703]
:POSTROUTING ACCEPT [3492061:253533144]
-A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 9809
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Tue May 20 18:51:46 2014

Update: Possible Solution Found

This looks like it is working:

From:

https://help.ubuntu.com/community/DansGuardian

sudo iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner --uid-owner proxy -j ACCEPT
sudo iptables -t nat -A OUTPUT -p tcp --dport 3128 -m owner --uid-owner proxy -j ACCEPT
sudo iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT --to-ports 8080
sudo iptables -t nat -A OUTPUT -p tcp --dport 3128 -j REDIRECT --to-ports 8080

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.