iptables rules for DNS/Transparent proxy with ip exceptions
- by SlimSCSI
I am running a router (A Netgear WNDR3700 if that matters) with dd-wrt.
For content filtering I am using OpenDNS. I wanted to make sure a user could not bypass OpenDNS by putting in their own name servers, so I have a rule to catch all DNS traffic.
iptables -t nat -A PREROUTING -i br0 -p all --dport 53 -j DNAT --to $LAN_IP
I did have one computer on the network I wanted to allow past OpenDNS filters. On that machine I manually set the name servers, and created another rule to allow it to pass
iptables -t nat -I PREROUTING -i br0 -s 192.168.1.2 -j ACCEPT
This worked well.
Today, I installed a transparent proxy (squid) on the router and added these rules:
iptables -t nat -A PREROUTING -i br0 -s $LAN_NET -d $LAN_NET -p tcp --dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -i br0 -s ! $PROXY_IP -p tcp --dport 80 -j DNAT --to $PROXY_IP:$PROXY_PORT
iptables -t nat -I POSTROUTING -o br0 -s $LAN_NET -d $PROXY_IP -p tcp -j SNAT --to $LAN_IP
iptables -I FORWARD -i br0 -o br0 -s $LAN_NET -d $PROXY_IP -p tcp --dport $PROXY_PORT -j ACCEPT
This also works, however the 192.168.1.2 address does not get routed through squid.
How can I have 192.168.1.2 (and maybe others in the future) by-pass the port 53 rules, but not the port 80 rules?
