having some trouble with fresh squid server on a VPS box.
I have the box secured with iptables,simple 'iptables -P INPUT DROP', and only my home ip is allowed to connect.
So, whatever http_port I set in squid.conf, squid does not listen when default action on INPUT chain is DROP (Currently I am using port 13631 as you can see in some configs below).
Just to be clear, I tried adding 'obvious' rules - accepting specific dport, specific local IP address/interface, they didn't fix the problem.
I have an openvpn server on the same box and it works with the only rule allowing my home IP to connect (2nd input rule below) so the basic rules seem to be working.
So this config works and squid listens on specific port:
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- <myip> anywhere
ACCEPT all -- 192.168.0.0/24 anywhere
root@aatest:~# netstat -ntlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 26548/sshd
tcp 0 0 0.0.0.0:13630 0.0.0.0:* LISTEN 887/openvpn
tcp 0 0 10.8.0.1:13631 0.0.0.0:* LISTEN 30715/(squid-1)
tcp6 0 0 :::22 :::* LISTEN 26548/sshd
But this one does not work -
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- <myip> anywhere
ACCEPT all -- 192.168.0.0/24 anywhere
root@aatest:~# netstat -ntlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 26548/sshd
tcp 0 0 0.0.0.0:13630 0.0.0.0:* LISTEN 887/openvpn
tcp6 0 0 :::22 :::* LISTEN 26548/sshd
So I need some help to figure out which exact rule I must add so squid would start listening correctly while iptables would still allow only one IP to connect to server.
I tried many types of rules - allowing local interface, local address, dport, etc, but squid just won't start to listen unless I allow any-any with default input policy or rule.
I think I need to allow something but if allowing port or ip doesn't work then I don't know what else to try.
Since I made a mistake before choosing wrong site for the question, I'll also paste my current iptables-save (did some experimenting there already, but with this config squid still does not listen when I restart it).
Also keep in mind, this box was first made for simple ovpn server, I just wanted to add a proxy server to it.
# Generated by iptables-save v1.8.2 on Sat Jul 27 08:41:10 2024
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [238615:172640979]
:OUTPUT ACCEPT [886422:1146802441]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -s <my ip> -j ACCEPT
-A INPUT -s 192.168.0.0/24 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 13631 -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Sat Jul 27 08:41:10 2024
# Generated by iptables-save v1.8.2 on Sat Jul 27 08:41:10 2024
*mangle
:PREROUTING ACCEPT [67190817:38175901140]
:INPUT ACCEPT [23057184:4713328157]
:FORWARD ACCEPT [44133612:33462571051]
:OUTPUT ACCEPT [34224044:37027164282]
:POSTROUTING ACCEPT [78357656:70489735333]
COMMIT
# Completed on Sat Jul 27 08:41:10 2024
# Generated by iptables-save v1.8.2 on Sat Jul 27 08:41:10 2024
*nat
:PREROUTING ACCEPT [177306:27232375]
:INPUT ACCEPT [15937:829028]
:OUTPUT ACCEPT [1275:80000]
:POSTROUTING ACCEPT [32:1318]
-A POSTROUTING -o venet0 -j MASQUERADE
COMMIT
# Completed on Sat Jul 27 08:41:10 2024
# Generated by iptables-save v1.8.2 on Sat Jul 27 08:41:10 2024
*raw
:PREROUTING ACCEPT [67190817:38175901140]
:OUTPUT ACCEPT [34224043:37027164098]
COMMIT
# Completed on Sat Jul 27 08:41:10 2024
# Generated by iptables-save v1.8.2 on Sat Jul 27 08:41:10 2024
*security
:INPUT ACCEPT [23045729:4712756627]
:FORWARD ACCEPT [44133612:33462571051]
:OUTPUT ACCEPT [34224043:37027164098]
COMMIT
# Completed on Sat Jul 27 08:41:10 2024
