[ubuntu] iptables settings

[BassTech]

We have configured Squid 3.3.8 on Ubuntu 13.10. Squid all seems ok, but we've come a little stuck on the iptables settings.

We want to basically forward all requests from our BYOD range (172.10.0.0) on eth0, onto eth1 (192.168.3.108) out to the internet.

Currently this is our /etc/iptables.up.rules config:

 

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t manlge -F
iptables -t mangle -X
#
iptables -A PREROUTING -m tcp -p tcp --src 172.10.0.0/21 --sport 80 --dst 172.10.0.2 --dport 3128 -j ACCEPT
iptables -A PREROUTING -m udp -p udp --src 172.10.0.0/21 --sport 80 --dst 172.10.0.2 --dport 3128 -j ACCEPT
iptables -A FORWARD -m tcp -p tcp --src 172.10.0.2 --sport 3128 --dst 192.168.3.108 --dport 80 -j ACCEPT
iptables -A FORWARD -m udp -p udp --src 172.10.0.2 --sport 3128 --dst 192.168.3.108 --dport 80 -j ACCEPT

 

But it doesn't seem to work - the clients get 'No DNS records' error which makes me think the traffic isn't being forwarded from Squid (172.10.0.2) onto the LAN-facing NIC (192.168.3.108)

Not sure what we're doing wrong - probably missing something obvious!

[ReBoot]

Not an expert on iptables. You might find it easier to use shorewall to configure and manage iptables. Thats what I did on my Ubuntu/Squid server. Bit easier to see whats going on.

[jinnantonnixx]

Try adding a line with UPD port 53 with a destination to your DNS server.

 

This might be of use.

25 Most Frequently Used Linux IPTables Rules Examples

[unixman_again]

The lazy admins method of configuring iptables is to use Guarddog or similar.

[BassTech]

The lazy admins method of configuring iptables is to use Guarddog or similar.

 

Looking into GUIs at the moment, currently using firestarter and got much further using it than manually configuring iptables.up.rules got a connection refused error now.