-A OUTPUT -p tcp --syn -s 192.168.1.1 --sport 1024: -d 192.168.1.5 --dport 80 -j ACCEPT -j -----Original Message----- From: Jim Matthews [mailto:jim.matthews@xxxxxxxxxxxxxx] Sent: Thursday, July 15, 2004 10:46 AM To: netfilter@xxxxxxxxxxxxxxxxxxx Subject: Squid Accelerator configuration Hi We have a backend web server. To off-load some of the load from the backend server, we have a Squid server in front. I am having an issue with my iptables configuration on my Squid box. Everything works correctly when I disable the firewall (no good), so I'm having problems with my rules on the Squid server. I want to configure the systems so that: -On Squid- -allow all requests from Internet to port 80 -allow all requests from WWW box to/from port 80 -On WWW- -allow all forwarded requests to/from Squid Box to port 80 -do not allow requests from Internet to port 80 Has anyone setup something similar? Any suggestions or pointers on how to configure this? Here is the ruleset I'm using on my Squid box: # Squid # These rules are to allow testing from the internal network - the first two rules are for the Squid port -A INPUT -s 192.168.1.0/24 -p tcp -m tcp --sport 1024: --dport squid -m state --state NEW,ESTABLISHED -j ACCEPT -A OUTPUT -s 192.168.1.0/24 -p tcp -m tcp --sport squid -m state --state ESTABLISHED -j ACCEPT # These two rules are for the http port -A INPUT -s 192.168.1.0/24 -p tcp -m tcp --sport 1024: --dport http -m state --state NEW,ESTABLISHED -j ACCEPT -A OUTPUT -s 192.168.1.0/24 -p tcp -m tcp --sport http -m state --state ESTABLISHED -j ACCEPT # These two rules should cover the forwarding of connections for the backend WWW server -A FORWARD -s 0/0 -d 192.168.1.5 -p TCP --sport 1024:65535 --dport 80 -j ACCEPT -A FORWARD -d 0/0 -s 192.168.1.5 -p TCP -m state --state ESTABLISHED -j ACCEPT Any help you could give would be greatly appreciated. Thanks. Thanks. --------------------- Jim Matthews ISS Systems Administrator Duke University - Perkins Library Box 90196 Durham, NC 27708 Email: jim.matthews@xxxxxxxx Voice: 919-660-5963 Fax: 919-684-6990
