Novell LINUX ENTERPRISE SERVER 11 - ADMINISTRATION Administration Manual page 447

Example 29.1 Firewall Configuration: Option 15
# 15.)
# Which accesses to services should be redirected to a local port on
# the firewall machine?
#
# This option can be used to force all internal users to surf via
# your squid proxy, or transparently redirect incoming webtraffic to
# a secure webserver.
#
# Format:
# list of <source network>[,<destination network>,<protocol>[,dport[:lport]]
# Where protocol is either tcp or udp. dport is the original
# destination port and lport the port on the local machine to
# redirect the traffic to
#
# An exclamation mark in front of source or destination network
# means everything EXCEPT the specified network
#
# Example: "10.0.0.0/8,0/0,tcp,80,3128 0/0,172.20.1.1,tcp,80,8080"
The comments above show the syntax to follow. First, enter the IP address and the
netmask of the internal networks accessing the proxy firewall. Second, enter the IP
address and the netmask to which these clients send their requests. In the case of Web
browsers, specify the networks 0/0, a wild card that means "to everywhere." After
that, enter the original port to which these requests are sent and, finally, the port to
which all these requests are redirected. Because Squid supports protocols other than
HTTP, redirect requests from other ports to the proxy, such as FTP (port 21), HTTPS,
or SSL (port 443). In this example, Web services (port 80) are redirected to the proxy
port (port 3128). If there are more networks or services to add, they must be separated
by a blank space in the respective entry.
FW_REDIRECT="192.168.0.0/16,0/0,tcp,80,3128"
To start the firewall and the new configuration with it, change an entry in the /etc/
sysconfig/SuSEfirewall2 file. The entry START_FW must be set to "yes".
Start Squid as shown in Section 29.3, "Starting Squid" (page 423). To verify that every-
thing is working properly, check the Squid logs in /var/log/squid/access.log.
To verify that all ports are correctly configured, perform a port scan on the machine
from any computer outside your network. Only the Web services (port 80) should be
open. To scan the ports with nmap, the command syntax is nmap -O IP_address.
The Proxy Server Squid 433