Am 09.05.20 um 09:42 schrieb Nicolas Kovacs: > Hi, > > I just setup a very basic HTTP proxy with Squid on a router running CentOS 7. > > Up until early 2020 I've been using a bone-headed shell script with iptables to > configure my firewall. But I decided to follow advice from a few gurus on this > list, and I've since moved my configurations to FirewallD, which works nicely. > > There's one configuration left to tackle, that's port redirection for the Squid > proxy server. Which also works fine, though I'd like to figure out a little > detail. Here goes. > > My router has two network interfaces, which I've aptly named WAN and LAN in the > NetworkManager configuration: > > $ nmcli con show > NAME UUID TYPE DEVICE > WAN 9574b606-8f6d-3edc-95ad-8165df0f3fce ethernet enp2s0 > LAN c726b168-1fcd-4dc5-a01d-8ad8a1ba38ee ethernet enp3s1 > > Squid is acting as a transparent proxy server: > > $ sudo grep http_port /etc/squid/squid.conf > http_port 3128 transparent > > In my firewall configuration, all requests to port 80 (HTTP) are redirected to > port 3128: > > $ sudo firewall-cmd --permanent > --add-forward-port=port=80:proto=tcp:toport=3128:toaddr=192.168.3.1 > $ sudo firewall-cmd --reload > $ sudo firewall-cmd --list-all > internal (active) > target: default > icmp-block-inversion: no > interfaces: enp3s1 > sources: > services: dhcp dns http squid ssh > ports: > protocols: > masquerade: no > forward-ports: port=80:proto=tcp:toport=3128:toaddr=192.168.3.1 > source-ports: > icmp-blocks: > rich rules: > > In the current state, this configuration works as expected. When a client > desktop in the 192.168.3.0/24 network browses HTTP sites on the web, it appears > in the Squid log on the server in /var/log/squid/access.log. > > And here comes the question. How can I redirect all HTTP requests to port 3128 > EXCEPT THOSE THAT ARE DIRECTLY AIMED AT THE PROXY SERVER? > > Here's the thing. The proxy server (amandine.sandbox.lan) is also running httpd > to display a static information page for the local network. Now client desktops > can access http://amandine.sandbox.lan in a web browser just fine. But this > still goes through the proxy, and I'd like these requests to rather be handled > directly. > > In iptables syntax this would vaguely look like this: > > $ iptables -A PREROUTING -t nat -i 192.168.3.1 -p tcp \ > ! -d 192.168.3.1 --dport 80 -j REDIRECT --to-port 3128 > > How can I translate the "! -d 192.168.3.1" part into some FirewallD-specific > syntax ? > Untested: $ man firewalld.richlanguage <paste> Destination destination [not] address="address[/mask]" </paste> -- Leon