Hello,
I am trying to setup Internet filtering on my system using Squid and Dansguardian. I need to run a transparent proxy so that there is no way around it. I got the filtering working properly, but when I enable the SuSE firewall and then try to visit a web site, the page just loads forever. This is for a Google Summer of Code project, so I do need to support running the SuSE firewall and cannot simply disable it.
Okay, so here’s my configuration.
Squid: port 3128
Dansguardian: port 8080
(these ports are non-negotiable and are standard, so please no suggestions to change Squid’s port to 80, since that would preclude running a web server on the same machine)
I then have the following custom iptables rules:
iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner --uid-owner squid -j ACCEPT
iptables -t nat -A OUTPUT -p tcp --dport 3128 -m owner --uid-owner squid -j ACCEPT
iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT --to-ports 8080
The last rule redirects all requests to port 80 to Dansguardian on port 8080 (which, in turn, forwards the requests to Squid). The first two rules ensure that Squid can request pages from the Internet.
Now, these work just fine when I have the SuSE firewall disabled. When I enable it, as I mentioned, pages just keep loading forever.
I have put these 3 custom rules in /etc/sysconfig/scripts/SuSEfirewall2-custom (I tried putting them in each of the hooks – none of them work for me) and in /etc/sysconfig/SuSEfirewall2, I have the following line:
FW_CUSTOMRULES="/etc/sysconfig/scripts/SuSEfirewall2-custom"
Okay great, so the SuSEfirewall2 script is loading the rules, and I can see that when I start the firewall and then view the NAT table:
js3:/home/jeff # rcSuSEfirewall2 start
Starting Firewall Initialization (phase 2 of 2) done
js3:/home/jeff # iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpt:http owner UID match squid
ACCEPT tcp -- anywhere anywhere tcp dpt:ndl-aas owner UID match squid
REDIRECT tcp -- anywhere anywhere tcp dpt:http redir ports 8080
Unfortunately, no pages will load after that. Before anyone suggests that I use the FW_REDIRECT configuration value in /etc/sysconfig/SuSEfirewall2, please keep in mind that that does not apply to packets originating from the firewall machine, and since this is a single-computer configuration, I cannot use FW_REDIRECT. Everything is originating from the firewall machine.
My iptables configuration (after enabling the firewall) is displayed below. I appreciate any help anyone can provide. This is for a Google Summer of Code project, so you’ll be helping me help the community. 
Thank you.
js3:/home/jeff # iptables-save
# Generated by iptables-save v1.4.2-rc1 on Sun Jul 5 12:47:46 2009
*mangle
:PREROUTING ACCEPT [34439:25220562]
:INPUT ACCEPT [34305:25177659]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [32999:4559728]
:POSTROUTING ACCEPT [32999:4559728]
COMMIT
# Completed on Sun Jul 5 12:47:46 2009
# Generated by iptables-save v1.4.2-rc1 on Sun Jul 5 12:47:46 2009
*nat
:PREROUTING ACCEPT [262:61482]
:POSTROUTING ACCEPT [2886:191563]
:OUTPUT ACCEPT [2683:179222]
-A OUTPUT -p tcp -m tcp --dport 80 -m owner --uid-owner squid -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 3128 -m owner --uid-owner squid -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080
COMMIT
# Completed on Sun Jul 5 12:47:46 2009
# Generated by iptables-save v1.4.2-rc1 on Sun Jul 5 12:47:46 2009
*raw
:PREROUTING ACCEPT [34945:25466868]
:OUTPUT ACCEPT [33465:4635679]
-A PREROUTING -i lo -j NOTRACK
-A OUTPUT -o lo -j NOTRACK
COMMIT
# Completed on Sun Jul 5 12:47:46 2009
# Generated by iptables-save v1.4.2-rc1 on Sun Jul 5 12:47:46 2009
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:forward_ext - [0:0]
:input_ext - [0:0]
:reject_func - [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state ESTABLISHED -j ACCEPT
-A INPUT -p icmp -m state --state RELATED -j ACCEPT
-A INPUT -i eth0 -j input_ext
-A INPUT -i wlan0 -j input_ext
-A INPUT -i pan0 -j input_ext
-A INPUT -i vmnet1 -j input_ext
-A INPUT -i vmnet8 -j input_ext
-A INPUT -i wmaster0 -j input_ext
-A INPUT -j input_ext
-A INPUT -m limit --limit 3/min -j LOG --log-prefix "SFW2-IN-ILL-TARGET " --log-tcp-options --log-ip-options
-A INPUT -j DROP
-A FORWARD -m physdev --physdev-is-bridged -j ACCEPT
-A FORWARD -m limit --limit 3/min -j LOG --log-prefix "SFW2-FWD-ILL-ROUTING " --log-tcp-options --log-ip-options
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -m limit --limit 3/min -j LOG --log-prefix "SFW2-OUT-ERROR " --log-tcp-options --log-ip-options
-A input_ext -m pkttype --pkt-type broadcast -j DROP
-A input_ext -p icmp -m icmp --icmp-type 4 -j ACCEPT
-A input_ext -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A input_ext -s 10.0.0.0/24 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A input_ext -m pkttype --pkt-type multicast -j DROP
-A input_ext -m limit --limit 3/min -j LOG --log-prefix "SFW2-INext-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_ext -j DROP
-A reject_func -p tcp -j REJECT --reject-with tcp-reset
-A reject_func -p udp -j REJECT --reject-with icmp-port-unreachable
-A reject_func -j REJECT --reject-with icmp-proto-unreachable
COMMIT
# Completed on Sun Jul 5 12:47:46 2009
Regards,
Jeff Shantz