Hello all,

first of all i'd like to wish you all happy holidays, and a merry belated christmas.

Secondly, i'm trying to setup  a centos 5.4 to act as:

1. firewall # can you check my config below and tell me if i missed anything? 2. DHCP # already configured 3. transparent squid proxy #  already configured 4. http (virtual hosts) # in the near future 5. squirrelmail # in the near future

- Relevant info:

Two NICs:

eth0 LAN: with dhcp service: 192.168.57.1(255.255.255.0) # my lan users are connected to this interface eth1 WAN: static: 172.16.2.14 gw/172.16.2.13 (255.255.255.248) # My isp is connected to this interface

I want my firewall to do the following:

1. get my box to be completely secure from outside access, in other words deny all access from the outside world to my box &/or my LAN 2. allow my LAN users to access the internet/ box without any restrictions, through a transparent squid installation

i've searched a bit online, i must admit i never used iptables before (i thought of using firestarter as it's graphical and am no iptables guru, not even a novice user though i've installed my box with no X  hence no graphical applications)

i finally used bits an pieces and came up with the following:

Chain INPUT (policy DROP) target     prot opt source               destination         ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED In_RULE_0  all  --  anywhere             172.16.2.14         In_RULE_2  udp  --  192.168.57.1         anywhere            udp multiport dports bootpc,bootps state NEW

Chain FORWARD (policy DROP) target     prot opt source               destination         ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED

Chain OUTPUT (policy DROP) target     prot opt source               destination         ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED Cid1888X3970.0  udp  --  192.168.57.1         anywhere            udp multiport dports bootpc,bootps state NEW Out_RULE_3  all  --  192.168.57.1         anywhere            state RELATED,ESTABLISHED Cid1594X3970.0  all  --  192.168.57.1         anywhere            state NEW

Chain Cid1594X3970.0 (1 references) target     prot opt source               destination         Out_RULE_4  all  --  anywhere             172.16.2.14         Out_RULE_4  all  --  anywhere             192.168.57.1

Chain Cid1888X3970.0 (1 references) target     prot opt source               destination         Out_RULE_2  all  --  anywhere             172.16.2.14         Out_RULE_2  all  --  anywhere             192.168.57.1

Chain In_RULE_0 (1 references) target     prot opt source               destination         LOG        all  --  anywhere             anywhere            LOG level info prefix `RULE 0 -- DENY ' DROP       all  --  anywhere             anywhere

Chain In_RULE_2 (1 references) target     prot opt source               destination         LOG        all  --  anywhere             anywhere            LOG level info prefix `RULE 2 -- ACCEPT ' ACCEPT     all  --  anywhere             anywhere

Chain Out_RULE_2 (2 references) target     prot opt source               destination         LOG        all  --  anywhere             anywhere            LOG level info prefix `RULE 2 -- ACCEPT ' ACCEPT     all  --  anywhere             anywhere

Chain Out_RULE_3 (1 references) target     prot opt source               destination         LOG        all  --  anywhere             anywhere            LOG level info prefix `RULE 3 -- ACCEPT ' ACCEPT     all  --  anywhere             anywhere

Chain Out_RULE_4 (2 references) target     prot opt source               destination         LOG        all  --  anywhere             anywhere            LOG level info prefix `RULE 4 -- ACCEPT ' ACCEPT     all  --  anywhere             anywhere