Book navigation

User Actions Menu

User login

Transparent Proxying and Unrestricted Hosts...

For anyone out there that is implementing transparent proxying/filtering on their network that might need to allow certian hosts unrestricted connections this is what I did...

Firewall in use: Smoothwall (http:/smoothwall.org) 2 Network cards on an old Pentium III box that someone was throwing away.
Modifications added...
-Dans Guardian w/ Antivirus (http://community.smoothwall.org/forum/viewtopic.php?t=8488)
-Privoxy (http://community.smoothwall.org/forum/viewtopic.php?t=12852)
-AdZap (http://community.smoothwall.org/forum/viewtopic.php?t=3299)
-Advanced Web Proxy (http://community.smoothwall.org/forum/viewtopic.php?t=11083)

After all that I configured the traffic to go like so...
Network Client -> Tranparent redirection to Dansgaurdian -> Squid -> AdZap -> Privoxy (privoxy gets other things) -> Internet.

Now this setup works great, bad sites are blocked, no one gets pop-ups, web browsing is faster, but their are certian things that will not work with this setup. One was the Nintento DS wifi or the TIVO, XBOX, web servers, etc. These need to get to the internet directly or the services that they need access to will not work. To do this you should look in the DHCP log(Click on Logs->Other->CHoose DHCP from drop down and press: Update), find the MAC address of the device that you need an exception for (it will look something like "DHCPREQUEST for 1.2.3.4 (4.3.2.1) from 00:00:11:22:33:44 (NintendoDS) via eth0" This tells you two important things: The MAC address (00:00:11:22:33:44) and the interface that the DHCP server is running on(in this case: eth0). Add the mac address to the DHCP server Reservations section under the services section and choose an IP address from your network range. So if you have something similar going on in your environment, do the following in order to allow that device access to the internet without being forced through the fiter...

If you are on a linux machine open a terming and type this at the prompt...
ssh root@smoothwall -p 222 (this will work in a default smoothwall installation)

On a windows machine download Putty (http://www.chiark.greenend.org.uk/~sgtatham/putty/) and enter in the host as: smoothwall and the port as: 222. It will ask you for the root password... root@smoothwall's password: Go ahead and type it in...

After logging in type this at the command line... joe /etc/rc.d/rc.firewall.up ("Joe" is an easy to use Text Editor.)

The rest is the path to the script that runs when the firewall starts. Look for the three lines that say...
/sbin/iptables -P INPUT DROP
/sbin/iptables -P FORWARD DROP
/sbin/iptables -P OUTPUT ACCEPT

and add this below them...

###Custom Rules #Unrestricted Host...
/sbin/iptables -t nat -I PREROUTING 1 -i eth0 -p tcp -s 1.2.3.4 --dport 80 -j ACCEPT
###End Custom Rules

Change the "1.2.3.4" to the IP address of the device on your network that needs non transparent access. Save the file by pressing and holding the CTRL key and then press K and then D (CTRL+K>D). The next time the firewall if rebooted the rule will take effect. (To reboot from ssh type: shutdown -r now and hit enter) You can test the rules just by typing on the command line and pressing enter also.

Good Luck!