how to block all trafic other then POP n SMTP

[Maaz]

Dear Gurus

About Internet Gateway Server:
Gateway IP: 10.0.0.110 (ip of the interface connected to the lan)
Gateway Software: Squid 2.6, and iptables.

how to block all trafic to the internet other then POP n SMTP for some clients ?.
Infect I have a LinuxRouter+Squid, and for some users 10.0.0.137, and 10.0.0.125 I just want to allow them access their emails using outlook, and nothing else.
I have denied http traffic using squid. But I wana know how can I also block non smtp/pop traffic using iptables

iptables script I am using at this gateway server is attached.

NOTE: the smtp, and pop server is on the internet

[Stuart Browne]

Change the filter table's FORWARD policy to DROP (this will block *EVERYTHING* except Squid from other computers), then explicity allow those two computers access through the forward table to the appropriate ports, i.e.

iptables -P FORWARD DROP
iptables -N MailAccess
iptables -A MailAccess -j ALLOW -p tcp --dport 110
iptables -A MailAccess -j ALLOW -p tcp --dport 25
iptables -A FORWARD -j MailAccess -s 10.10.10.125
iptables -A FORWARD -j MailAccess -s 10.10.10.137

[Maaz]

Thanks Stuart, for prompt help.

other then 125, and 137, all the 10.0.0.0/24 are allowed to access everything, i.e unlimited access to the internet for clients, other 10.0.0.125, and 10.0.0.137.

regards

[Stuart Browne · Accepted solution]

Ah. In that case, you want to take a different approach. Ignore the previous stuff entirely, and do this:

iptables -N MailAccess
iptables -A MailAccess -j ACCEPT -p tcp --dport 25
iptables -A MailAccess -j ACCEPT -p tcp --dport 110
iptables -A MailAccess -j REJECT
iptables -A FORWARD -j MailAccess -s 10.10.10.125
iptables -A FORWARD -j MailAccess -s 10.10.10.137

This will give them only access to those two ports, and whatever access squid gives them.

[Steven E. Protter]

Shalom,

I'd suggest an iptables configuration.

A quick alternative to iptables code is firestarter.

http://fs-security.com

It has a gui and is easily configurable.

The product is open source, lacks a web interface and may be orphaned. The community is working on taking over the product.

Go for strict inbound and outbound policy and then open up port 25 and port 110. Note this configuration will block http/https traffic.

SEP

[Maaz]

Once again Thanks Stuart and SEP for help/support.

Stuart I didnt tried the code(iptables), but as soon as I get the downtime, I'll try the code.. and obviously point will also be assign later ;) .

Regards
Maaz

[Steven E. Protter]

Just wanted you to know,

You can't play with Stuart's option and mine at the same time.

firestarter uses iptables code. If you shut iptables, firestarter configuration goes down.

SEP

[Maaz]

Thanks SEP.

Stuart I have attached the modified script(that has your code), but from 10.0.0.125, and 10.0.0.137 I can still use Yahoo, and MSN messengers(and other apps that connects to internet).

I hope i have cleared my question, i,e I just want 10.0.0.125, and 10.0.0.137 to access emails from Email-Servers(pop/smtp) on the internet.
But all other machines(10.0.0.0/24) must have full access to the internet

I have configured transparent proxy, and every client including 10.0.0.125, and 137, has the following TCP/IP configs
IP: 10.0.0.x
NETMASK: 255.255.255.0
GATEWAY: 10.0.0.110
DNS SERVER: 10.0.0.110

Squid is listning on port 3128, and all the traffic directed to port 80 from clients are redirected to 3128 via iptables.

No client has proxy server settings, i.e no TCP/IP(proxy server)configs are provided to the applications(web-browser, msn, and yahoo messengers etc)

Regards