<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2800.1276" name=GENERATOR></HEAD>
<BODY>
<DIV><SPAN class=265101709-03122003><FONT face=Arial
size=2>Hi,</FONT></SPAN></DIV>
<DIV><SPAN class=265101709-03122003><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=265101709-03122003><FONT face=Arial size=2>What I am trying to
accomplish is to denigh access to the internet from certain users and enable for
others, but the transparent proxy doesn't seem to be
working.</FONT></SPAN></DIV>
<DIV><SPAN class=265101709-03122003><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=265101709-03122003><FONT face=Arial size=2>My firehol.conf is
as follows:</FONT></SPAN></DIV>
<DIV><SPAN class=265101709-03122003><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=265101709-03122003><FONT face=Arial
size=2>--------------------------------------------</FONT></SPAN></DIV>
<DIV><SPAN class=265101709-03122003><FONT face=Arial size=2>#<BR># $Id:
client-all.conf,v 1.2 2002/12/31 15:44:34 ktsaou Exp $<BR>#<BR># This
configuration file will allow all requests originating from the<BR># local
machine to be send through all network interfaces.<BR>#<BR># No requests are
allowed to come from the network. The host will be<BR># completely stealthed! It
will not respond to anything, and it will<BR># not be pingable, although it will
be able to originate anything<BR># (even pings to other
hosts).<BR>#</FONT></SPAN></DIV>
<DIV> </DIV>
<DIV><SPAN class=265101709-03122003><FONT face=Arial size=2># Require release 5
of FireHOL configuration directives<BR>version 5</FONT></SPAN></DIV>
<DIV> </DIV>
<DIV><SPAN class=265101709-03122003><FONT face=Arial size=2># Internal Network
IP Address<BR>lan_ips="192.168.69.0/24"<BR>accepted_ips="`cat
/etc/firehol/ips.txt | grep -v '^#'`"</FONT></SPAN></DIV>
<DIV> </DIV>
<DIV><SPAN class=265101709-03122003><FONT face=Arial size=2># Transparent
Proxy<BR>transparent_squid 8080 "squid root" inface eth0 src
"${lan_ips}"</FONT></SPAN></DIV>
<DIV> </DIV>
<DIV><SPAN class=265101709-03122003><FONT face=Arial size=2># My LAN. Everything
is allowed here.<BR>interface eth0 lan src
"${lan_ips}"<BR> server
dns accept<BR>
server squid
accept<BR> server
ssh accept<BR>
server http
accept<BR> server
ftp accept<BR>
server smtp
accept<BR> server
dhcp accept<BR>
policy reject</FONT></SPAN></DIV>
<DIV> </DIV>
<DIV><SPAN class=265101709-03122003><FONT face=Arial size=2>interface eth1
internet src not "${lan_ips}
${UNROUTABLE_IPS}"<BR>
protection strong 10/sec
10<BR> server
ssh accept<BR>
server http
accept<BR> server
ident reject with
tcp-reset<BR> client
all accept</FONT></SPAN></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><SPAN class=265101709-03122003><FONT face=Arial size=2>router internet2lan
inface eth1 outface eth0<BR>
masquerade
reverse<BR> client
all accept src
"${accepted_ips}"<BR> server
ident reject with tcp-reset</FONT></SPAN></DIV>
<DIV><SPAN class=265101709-03122003><FONT face=Arial
size=2>-----------------------------------</FONT></SPAN></DIV>
<DIV><SPAN class=265101709-03122003><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=265101709-03122003><FONT face=Arial size=2>ips.txt is as
follows</FONT></SPAN></DIV>
<DIV><SPAN class=265101709-03122003><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=265101709-03122003><FONT face=Arial
size=2>192.168.69.1</FONT></SPAN></DIV>
<DIV><SPAN class=265101709-03122003><FONT face=Arial
size=2>192.168.69.5</FONT></SPAN></DIV>
<DIV><SPAN class=265101709-03122003><FONT face=Arial
size=2>192.168.69.69</FONT></SPAN></DIV>
<DIV><SPAN class=265101709-03122003><FONT face=Arial
size=2>192.168.69.205</FONT></SPAN></DIV>
<DIV><SPAN class=265101709-03122003><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=265101709-03122003><FONT face=Arial size=2>But I need the other
machines in the network to receive there dhcp from the box, there IP just won't
be allowed at the router rule.</FONT></SPAN></DIV>
<DIV><SPAN class=265101709-03122003><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=265101709-03122003><FONT face=Arial size=2>At the moment that
seems to be working, except the transparent proxy doesn't seem to be working
corrently, if I do the rules manually with a plain iptables set of rules it
works no problems, I seem to have something wrong in the firehol
configuration.</FONT></SPAN></DIV>
<DIV><SPAN class=265101709-03122003><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=265101709-03122003><FONT face=Arial size=2>Any help would be
very much appreciated.</FONT></SPAN></DIV>
<DIV><SPAN class=265101709-03122003><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=265101709-03122003><FONT face=Arial
size=2>J</FONT></SPAN></DIV></BODY></HTML>