I'm in the process of adding some parental control to my box (http filtering).

The box is used by the whole family (one account for each member) and squid runs on the very same machine.

I have two squid instances, one (for adults) only for caching, one (for children) using squidGuard.

To choose between both squid instances, I use --uid-owner with NAT rules.

iptables -t nat -A OUTPUT -m owner --uid-owner $owner -p tcp -m tcp --dport 80 -j REDIRECT --to-ports $port

(ditto for ip6tables)

Currently I use NAT for both IPv4 and IPv6 (with a fairly recent linux kernel), but Squid says that "intercept" only supports IPv4. I would like to have IPv6 too.

I tried to use TPROXY (e.g. using these rules) but I failed because I need --uid-owner which iptables wants to set on POSTROUTING (not on PREROUTING).

Those rules are:

iptables -t mangle -N DIVERT
iptables -t mangle -A DIVERT -j MARK --set-mark 1
iptables -t mangle -A DIVERT -j ACCEPT
iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129

How do I add appropriate --uid-owner rules in that mangle table? I mean, how do I decide to forward to port 3128 or 3129?

Edit: please don't answer saying that my NAT rule works well. I know that. I need to get rid of NAT because Squid's NAT is IPv4 only. So please, again, no NAT. Only TPROXY or mangle or whatever you call it that works with the mangle rules above.

  • Is your "box" a router or the system you are working on? You don't make that clear and the point is: --uid-owner makes sense on a user system only, PREROUTING on a router only. The page you refer to is about router configuration. – Hauke Laging May 21 '13 at 21:23
  • ok sorry. Both. I'm at home, I don't have that many computers ;-) I'll clarify, thanks – cadrian May 22 '13 at 8:42

You don't need --uid-owner in PREROUTING, you need it in OUTPUT (like in your example).

  • so I just need to replace -t nat by -t mangle and all is well? – cadrian May 21 '13 at 4:41
  • @cadrian No, REDIRECT works in nat only but nat has an OUTPUT chain, too. Your example rule should be enough. PREROUTING is not used for locally generated packets and POSTROUTING can't do DNAT / REDIRECT. – Hauke Laging May 21 '13 at 12:46
  • Sorry I don't understand. How do I use tproxy then? – cadrian May 21 '13 at 17:57
  • @cadrian I don't understand the problem. I don't know tproxy but it probably is a proxy server listening in the localhost interface. Thus your rule should work. I assume it doesn't; otherwise you wouldn't have asked... Please provide the output of tcpdump -i lo -n. Are there INPUT rules blocking traffic to lo? – Hauke Laging May 21 '13 at 18:05
  • I tried to clarify the question. Please read it again. Do you now understand my problem? Thanks. – cadrian May 21 '13 at 19:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.