topic Re: how to block all trafic other then POP n SMTP in Operating System - Linux

how to block all trafic other then POP n SMTP

Maaz — Tue, 04 Sep 2007 04:09:38 GMT

Dear Gurus

About Internet Gateway Server:
Gateway IP: 10.0.0.110 (ip of the interface connected to the lan)
Gateway Software: Squid 2.6, and iptables.

how to block all trafic to the internet other then POP n SMTP for some clients ?.
Infect I have a LinuxRouter+Squid, and for some users 10.0.0.137, and 10.0.0.125 I just want to allow them access their emails using outlook, and nothing else.
I have denied http traffic using squid. But I wana know how can I also block non smtp/pop traffic using iptables

iptables script I am using at this gateway server is attached.

NOTE: the smtp, and pop server is on the internet

Re: how to block all trafic other then POP n SMTP

Stuart Browne — Tue, 04 Sep 2007 05:12:25 GMT

Change the filter table's FORWARD policy to DROP (this will block *EVERYTHING* except Squid from other computers), then explicity allow those two computers access through the forward table to the appropriate ports, i.e.

iptables -P FORWARD DROP
iptables -N MailAccess
iptables -A MailAccess -j ALLOW -p tcp --dport 110
iptables -A MailAccess -j ALLOW -p tcp --dport 25
iptables -A FORWARD -j MailAccess -s 10.10.10.125
iptables -A FORWARD -j MailAccess -s 10.10.10.137

Re: how to block all trafic other then POP n SMTP

Maaz — Tue, 04 Sep 2007 06:46:50 GMT

Thanks Stuart, for prompt help.

other then 125, and 137, all the 10.0.0.0/24 are allowed to access everything, i.e unlimited access to the internet for clients, other 10.0.0.125, and 10.0.0.137.

regards

Re: how to block all trafic other then POP n SMTP

Stuart Browne — Tue, 04 Sep 2007 07:38:29 GMT

Ah. In that case, you want to take a different approach. Ignore the previous stuff entirely, and do this:

iptables -N MailAccess
iptables -A MailAccess -j ACCEPT -p tcp --dport 25
iptables -A MailAccess -j ACCEPT -p tcp --dport 110
iptables -A MailAccess -j REJECT
iptables -A FORWARD -j MailAccess -s 10.10.10.125
iptables -A FORWARD -j MailAccess -s 10.10.10.137

This will give them only access to those two ports, and whatever access squid gives them.

Re: how to block all trafic other then POP n SMTP

Steven E. Protter — Tue, 04 Sep 2007 08:09:31 GMT

Shalom,

I'd suggest an iptables configuration.

A quick alternative to iptables code is firestarter.

http://fs-security.com

It has a gui and is easily configurable.

The product is open source, lacks a web interface and may be orphaned. The community is working on taking over the product.

Go for strict inbound and outbound policy and then open up port 25 and port 110. Note this configuration will block http/https traffic.

SEP

Re: how to block all trafic other then POP n SMTP

Maaz — Wed, 05 Sep 2007 07:11:38 GMT

Once again Thanks Stuart and SEP for help/support.

Stuart I didnt tried the code(iptables), but as soon as I get the downtime, I'll try the code.. and obviously point will also be assign later ;) .

Regards
Maaz

Re: how to block all trafic other then POP n SMTP

Steven E. Protter — Wed, 05 Sep 2007 11:59:34 GMT

Just wanted you to know,

You can't play with Stuart's option and mine at the same time.

firestarter uses iptables code. If you shut iptables, firestarter configuration goes down.

SEP

Re: how to block all trafic other then POP n SMTP

Maaz — Thu, 06 Sep 2007 04:53:06 GMT

Thanks SEP.

Stuart I have attached the modified script(that has your code), but from 10.0.0.125, and 10.0.0.137 I can still use Yahoo, and MSN messengers(and other apps that connects to internet).

I hope i have cleared my question, i,e I just want 10.0.0.125, and 10.0.0.137 to access emails from Email-Servers(pop/smtp) on the internet.
But all other machines(10.0.0.0/24) must have full access to the internet

I have configured transparent proxy, and every client including 10.0.0.125, and 137, has the following TCP/IP configs
IP: 10.0.0.x
NETMASK: 255.255.255.0
GATEWAY: 10.0.0.110
DNS SERVER: 10.0.0.110

Squid is listning on port 3128, and all the traffic directed to port 80 from clients are redirected to 3128 via iptables.

No client has proxy server settings, i.e no TCP/IP(proxy server)configs are provided to the applications(web-browser, msn, and yahoo messengers etc)

Regards