Filtering wireless with Dansguardian (ruckus and dlink)

[Shorty]

Matt at the moment I am thinking that the only way to do this is as you say to get the students or guests to input the proxy settings. Which isnt ideal hence me having ago at the transparent proxy. Hopefully I am wrong and Stuart or one of the other Ruckus experts will just point out the error of my ways ;-).

I was expecting the Ruckus ACL to have some sort of Network Address Translation to it but it seems to just be filtering.

[mattpant]

Fingers crossed somebody will have an answer on how to do this... what I think is missing from the console, and hopefully can be included in a future update is a proxy forwarder.

Hopefully there is a way around it!

Cheers

Matt

[tom_newton]

Try using DHCP to push out a proxy.pac - might work for a good handful of users, the rest can type it in.

[Cools]

Iptables configuration
Next, I had added following rules to forward all http requests (coming to port 80) to the Squid server port 3128 :

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to 192.168.1.1:3128
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080

Here is complete shell script. Script first configure Linux system as router and forwards all http request to port 3128 (Download the fw.proxy shell script):

#!/bin/sh
# squid server IP
SQUID_SERVER="192.168.1.1"
# Interface connected to Internet
INTERNET="eth0"
# Interface connected to LAN
LAN_IN="eth1"
# Squid port
SQUID_PORT="8080"
# DO NOT MODIFY BELOW
# Clean old firewall
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
# Load IPTABLES modules for NAT and IP conntrack support
modprobe ip_conntrack
modprobe ip_conntrack_ftp
# For win xp ftp client
#modprobe ip_nat_ftp
echo 1 > /proc/sys/net/ipv4/ip_forward
# Setting default filter policy
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
# Unlimited access to loop back
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# Allow UDP, DNS and Passive FTP
iptables -A INPUT -i $INTERNET -m state --state ESTABLISHED,RELATED -j ACCEPT
# set this system as a router for Rest of LAN
iptables --table nat --append POSTROUTING --out-interface $INTERNET -j MASQUERADE
iptables --append FORWARD --in-interface $LAN_IN -j ACCEPT
# unlimited access to LAN
iptables -A INPUT -i $LAN_IN -j ACCEPT
iptables -A OUTPUT -o $LAN_IN -j ACCEPT
# DNAT port 80 request comming from LAN systems to squid 3128 ($SQUID_PORT) aka transparent proxy
iptables -t nat -A PREROUTING -i $LAN_IN -p tcp --dport 80 -j DNAT --to $SQUID_SERVER:$SQUID_PORT
# if it is same system
iptables -t nat -A PREROUTING -i $INTERNET -p tcp --dport 80 -j REDIRECT --to-port $SQUID_PORT
# DROP everything and Log it
iptables -A INPUT -j LOG
iptables -A INPUT -j DROP

Save shell script. Execute script so that system will act as a router and forward the ports:

 chmod +x /etc/fw.proxy
 /etc/fw.proxy
 service iptables save
 chkconfig iptables on

Start or Restart the squid:

 /etc/init.d/squid restart
 chkconfig squid on

Desktop / Client computer configuration
Point all desktop clients to your eth1 IP address (192.168.2.1) as Router/Gateway (use DHCP to distribute this information). You do not have to setup up individual browsers to work with proxies.

[Shorty]

Thanks for the help Cools

Can I just clarify is the following added too the iptables or iptable-config file ?

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to 192.168.1.1:3128
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080

[Shorty]

Just found this How-To for the transparent proxy

Linux: Setup a transparent proxy with Squid in three easy steps

I think its the full ver of Cools paste. Still unsure though if I am editing IPtables or IPtables-config.

I had forgot the DG box only has one network cards so going to have to pop another in