# Problems w/ server with two subnetworks,one content-filtered

## Lebkoungcity

Hi there,

I have some problems setting up networks. 

There's a server that's connected to the internet via a ethernet-modem. It has three ethernetcards: one for the modem, one with the ip 192.168.0.1 and one with 192.168.1.1.

The server should provide iptables for all traffic to and from the internet.

The subnet 192.168.0.0 should have unrestricted access to the internet.

The internet-traffic of the subnet 192.168.1.0 has to be contend-filtered (by the server).

I'm trying for two days now and can't get it going...

I tried to write my own iptables-rules but gave up and tried ipkungfu which gave me internet-access on all boxes (listing of ipkungfu.conf, the output of iptables -L and iptables -S below).

But I can't manage the content-filtering via squid and dansguardian (listing of squid.conf and dansguardian.conf below.)

Right now I feel kind of stupid not to understand the syntax of iptables (or shorewall) and squid...

I would appreciate any help!

Andy

```
ipkungfu.conf

# =========================================================================

# $Id: ipkungfu.conf 57 2005-11-02 17:04:20Z s0undt3ch $

# =========================================================================

# Please read the README and FAQ for more information

# Some distros (most notably Redhat) don't have

# everything we need in $PATH so we specify it here.

# Make sure modprobe, iptables, and route are here,

# as well as ordinary items such as echo and grep.

# Default is as shown in the example below.

#PATH=/sbin:/usr/sbin:/bin:/usr/bin:/usr/local/bin:/usr/local/sbin

# Set the path to ipkungfu's runtime error log.

# Default: /var/log/ipkungfu.log

#IPKUNGFU_LOG=

# Your external interface

# This is the one that connects to the internet.

# Ipkungfu will detect this if you don't specify.

#EXT_NET="eth0"

#EXT_NET="eth1"

#EXT_NET="ppp0"

# Your internal interfaces, if any.  If you have more

# than 1 internal interface, separate them with

# spaces.  If you only have one interface, put "lo"

# here. Default is auto-detected.

INT_NET="eth0 eth2"

#INT_NET="eth1"

#INT_NET="lo"

# IP Range of your internal network.  Use "127.0.0.1"

# for a standalone machine.  Default is a reasonable

# guess. Separate multiple ranges with spaces.

LOCAL_NET="192.168.0.0/255.255.255.0 192.168.1.0/255.255.255.0"

# Set this to 0 for a standalone machine, or 1 for

# a gateway device to share an Internet connection.

# Default is 1.

GATEWAY=1

# TCP ports you want to allow for incoming traffic

# Don't add ports here that you intend to forward.

# This should be a list of tcp ports that have

# servers listening on them on THIS machine,

# separated by spaces. You can add port ranges

# delimited by hyphens, such as "20-22". Default 

# is none.

#ALLOWED_TCP_IN="21 22"

# UDP ports to allow for incoming traffic

# See the comments above for ALLOWED_TCP_IN

#ALLOWED_UDP_IN=""

# Temporarily block future connection attempts from an

# IP that hits these ports (If module is present)

# Hits to these ports will be logged as "BADGUY" hits

# regardless of log.conf settings.

#FORBIDDEN_PORTS="135 137 139"

# Drop all ping packets?

# Set to 1 for yes, 0 for no. Default is no.

BLOCK_PINGS=0

# Possible values here are "DROP", "REJECT", or "MIRROR"

#

# "DROP" means your computer will not respond at all. "Stealth mode"

#

# "REJECT" means your computer will respond with a

# message that the packet was rejected.

#

# "MIRROR", if your kernel supports it, will swap the source and

#   destination IP addresses, and send the offending packet back

#   where it came from.  USE WITH EXTREME CAUTION! Only use this if you fully

#   understand the consequences.

#

# The safest option, and the default in each case,,  is "DROP". Don't change 

# unless you fully understand this.

# What to do with 'probably malicious' packets

#SUSPECT="REJECT" 

SUSPECT="DROP"

# What to do with obviously invalid traffic

# This is also the action for FORBIDDEN_PORTS

#KNOWN_BAD="REJECT"

KNOWN_BAD="DROP"

# What to do with port scans

#PORT_SCAN="REJECT"

PORT_SCAN="DROP"

# How should ipkungfu determine your IP address? The default

# answer, "NONE", will cause ipkungfu to not use the few

# features that require it to know your external IP address.

# This option is good for dialup users who run ipkungfu on

# bootup, since dialup users rarely use the features that

# require this, and the IP address for a dialup connection

# generally isn't known at bootup.  "AUTO" will cause

# ipkungfu to automatically determine the IP address of

# $EXT_NET when it is started.  If you have a static IP

# address you can simply enter your IP address here.

# If you do port forwarding and your ISP changes your IP

# address, choose NONE here, or your port forwarding

# will break when your IP address changes. Default is

# "NONE".

GET_IP="NONE"

#GET_IP="AUTO"

#GET_IP="128.238.244.16"

# If the target for identd (113/tcp) is DROP, it can take

# a long time to connect to some IRC servers. Set this to

# 1 to speed up these connections with a negligible cost

# to security.  Identd probes will be rejected with the

# 'reject-with-tcp-reset' option to close the connection

# gracefully. If you want to actually allow ident probes,

# and you're running an identd, and you've allowed port

# 113 in ALLOWED_TCP_IN, set this to 0. Default is 0.

#DONT_DROP_IDENTD=0

# Set this to 0 if you're running ipkungfu on a machine

# inside your LAN.  This will cause private IP addresses

# coming in on $EXT_NET to be identified as a spoof,

# which would be inaccurate on intra-LAN traffic

# This will cause private IP addresses coming in on 

# $EXT_NET to be identified as a spoof. Default is 1.

#DISALLOW_PRIVATE=1

# For reasons unknown to me, ipkungfu sometimes causes

# kernel panics when run at init time. This is my

# attempt to work around that.  Ipkungfu will wait

# the specified number of seconds before starting, to

# let userspace/kernel traffic catch up before executing.

# Default is 0.

#WAIT_SECONDS=5

# This option, if enabled, will cause ipkungfu to set

# the default policy on all builtin chains in the filter

# table to ACCEPT in the event of a failure.  This is 

# intended for remote administrators who may be locked 

# out of the firewall if ipkungfu fails.  A warning to 

# this effect will be echoed so that the situation can be

# rectified quickly.  This is the same as running

# ipkungfu with --failsafe.  Default is 0.

#FAILSAFE=0

# Configurable list of kernel modules to load at runtime.

# If no list is provided, the default and needed ones,

# ip_nat_irc, ip_conntrack_ftp ip_nat_ftp ip_conntrack_irc,

# will still be loaded.

#MODULES_LIST=""

```

```
 iptables -L

Chain INPUT (policy DROP)

target     prot opt source               destination         

ACCEPT     all  --  192.168.1.0/24       anywhere             state NEW

ACCEPT     all  --  192.168.0.0/24       anywhere             state NEW

ACCEPT     all  --  anywhere             anywhere             state NEW

ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED

LOG        all  --  0.0.0.1              anywhere             LOG level warning prefix "IPKF_IPKungFu "

DROP       all  --  anywhere             anywhere             recent: CHECK seconds: 120 name: badguy side: source

LOG        tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_flags_ALL: "

LOG        tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/NONE limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_flags_NONE: "

LOG        tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/FIN,PSH,URG limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_PORTSCAN_nmap_XMAS: "

LOG        tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/FIN limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_PORTSCAN_nmap_FIN: "

LOG        tcp  --  anywhere             anywhere             tcpflags: FIN,SYN/FIN,SYN limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_flags_SYN_FIN: "

LOG        tcp  --  anywhere             anywhere             tcpflags: SYN,RST/SYN,RST limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_flags_SYN_RST: "

LOG        tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,ACK,URG limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_SYN_RST_ACK_FIN_URG: "

LOG        tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/NONE limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_PORTSCAN_nmap_NULL: "

DROP       tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,ACK,URG

DROP       tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/NONE

DROP       tcp  --  anywhere             anywhere             tcpflags: FIN,SYN/FIN,SYN

DROP       tcp  --  anywhere             anywhere             tcpflags: SYN,RST/SYN,RST

DROP       tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/FIN,PSH,URG

DROP       tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG

DROP       tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/FIN

DROP       tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/NONE

ACCEPT     icmp --  anywhere             anywhere             icmp echo-request

LOG        tcp  --  anywhere             anywhere             state INVALID limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_Invalid_TCP_Flag: "

DROP       all  --  anywhere             anywhere             state INVALID

LOG        icmp --  anywhere             anywhere             icmp timestamp-request limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_ICMP_Timestamp: "

DROP       icmp --  anywhere             anywhere             icmp timestamp-request

syn-flood  tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,ACK/SYN

LOG        tcp  --  anywhere             anywhere             tcpflags:! SYN,RST,ACK/SYN state NEW limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_New_Not_SYN: "

DROP       tcp  --  anywhere             anywhere             tcpflags:! SYN,RST,ACK/SYN state NEW

DROP       tcp  --  anywhere             anywhere             multiport dports netbios-ns,6666

DROP       udp  --  anywhere             anywhere             multiport dports ms-sql-m

LOG        all  --  10.0.0.0/8           anywhere             limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_Spoof: "

LOG        all  --  172.16.0.0/12        anywhere             limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_Spoof: "

LOG        all  --  192.168.0.0/16       anywhere             limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_Spoof: "

LOG        all  --  loopback/24          anywhere             limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_Spoof: "

LOG        all  --  link-local/16        anywhere             limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_Spoof: "

LOG        all  --  192.0.2.0/24         anywhere             limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_Spoof: "

LOG        all  --  198.18.0.0/15        anywhere             limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_Spoof: "

LOG        all  --  255.255.255.255      anywhere             limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_Spoof: "

DROP       all  --  10.0.0.0/8           anywhere            

DROP       all  --  172.16.0.0/12        anywhere            

DROP       all  --  192.168.0.0/16       anywhere            

DROP       all  --  loopback/24          anywhere            

DROP       all  --  link-local/16        anywhere            

DROP       all  --  192.0.2.0/24         anywhere            

DROP       all  --  198.18.0.0/15        anywhere            

DROP       all  --  255.255.255.255      anywhere            

DROP       all  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)

target     prot opt source               destination         

ACCEPT     all  --  192.168.1.0/24       anywhere             state NEW

ACCEPT     all  --  192.168.0.0/24       anywhere             state NEW

ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED

REJECT     udp  --  192.168.1.0/24       anywhere             state INVALID reject-with icmp-port-unreachable

REJECT     tcp  --  192.168.1.0/24       anywhere             state INVALID reject-with icmp-port-unreachable

REJECT     udp  --  192.168.0.0/24       anywhere             state INVALID reject-with icmp-port-unreachable

REJECT     tcp  --  192.168.0.0/24       anywhere             state INVALID reject-with icmp-port-unreachable

DROP       all  --  anywhere             anywhere             recent: CHECK seconds: 120 name: badguy side: source

LOG        tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_flags_ALL: "

LOG        tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/NONE limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_flags_NONE: "

LOG        tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/FIN,PSH,URG limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_flags_FIN_URG_PSH: "

LOG        tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/FIN limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_PORTSCAN_nmap_XMAS: "

LOG        tcp  --  anywhere             anywhere             tcpflags: FIN,SYN/FIN,SYN limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_flags_SYN_FIN: "

LOG        tcp  --  anywhere             anywhere             tcpflags: SYN,RST/SYN,RST limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_flags_SYN_RST: "

LOG        tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,ACK,URG limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_SYN_RST_ACK_FIN_URG: "

LOG        tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/NONE limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_PORTSCAN_nmap_NULL: "

DROP       tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/NONE

DROP       tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,ACK,URG

DROP       tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/NONE

DROP       tcp  --  anywhere             anywhere             tcpflags: FIN,SYN/FIN,SYN

DROP       tcp  --  anywhere             anywhere             tcpflags: SYN,RST/SYN,RST

DROP       tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/FIN,PSH,URG

DROP       tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG

DROP       tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,PSH,ACK,URG/FIN

LOG        tcp  --  anywhere             anywhere             state INVALID limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_Invalid_TCP_flag: "

DROP       all  --  anywhere             anywhere             state INVALID

LOG        icmp --  anywhere             anywhere             icmp timestamp-request limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_ICMP_Timestamp: "

DROP       icmp --  anywhere             anywhere             icmp timestamp-request

syn-flood  tcp  --  anywhere             anywhere             tcpflags: FIN,SYN,RST,ACK/SYN

LOG        tcp  --  anywhere             anywhere             tcpflags:! SYN,RST,ACK/SYN state NEW limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_New_Not_SYN: "

DROP       tcp  --  anywhere             anywhere             tcpflags:! SYN,RST,ACK/SYN state NEW

DROP       tcp  --  anywhere             anywhere             multiport dports netbios-ns,6666

DROP       udp  --  anywhere             anywhere             multiport dports ms-sql-m

LOG        all  --  10.0.0.0/8           anywhere             limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_Spoof: "

LOG        all  --  172.16.0.0/12        anywhere             limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_Spoof: "

LOG        all  --  192.168.0.0/16       anywhere             limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_Spoof: "

LOG        all  --  loopback/24          anywhere             limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_Spoof: "

LOG        all  --  link-local/16        anywhere             limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_Spoof: "

LOG        all  --  192.0.2.0/24         anywhere             limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_Spoof: "

LOG        all  --  198.18.0.0/15        anywhere             limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_Spoof: "

LOG        all  --  255.255.255.255      anywhere             limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_Spoof: "

DROP       all  --  10.0.0.0/8           anywhere            

DROP       all  --  172.16.0.0/12        anywhere            

DROP       all  --  192.168.0.0/16       anywhere            

DROP       all  --  loopback/24          anywhere            

DROP       all  --  link-local/16        anywhere            

DROP       all  --  192.0.2.0/24         anywhere            

DROP       all  --  198.18.0.0/15        anywhere            

DROP       all  --  255.255.255.255      anywhere            

Chain OUTPUT (policy ACCEPT)

target     prot opt source               destination         

ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED

ACCEPT     all  --  anywhere             anywhere             state NEW

Chain syn-flood (2 references)

target     prot opt source               destination         

RETURN     all  --  anywhere             anywhere             limit: avg 10/sec burst 24

LOG        all  --  anywhere             anywhere             limit: avg 3/sec burst 5 LOG level warning prefix "IPKF_SYN_flood: "

DROP       all  --  anywhere             anywhere

```

```
 iptables -S

-P INPUT DROP

-P FORWARD ACCEPT

-P OUTPUT ACCEPT

-N syn-flood

-A INPUT -s 192.168.1.0/24 -i eth2 -m state --state NEW -j ACCEPT

-A INPUT -s 192.168.0.0/24 -i eth0 -m state --state NEW -j ACCEPT

-A INPUT -i lo -m state --state NEW -j ACCEPT

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

-A INPUT -s 0.0.0.1/32 -i eth0 -j LOG --log-prefix "IPKF_IPKungFu "

-A INPUT -m recent --rcheck --seconds 120 --name badguy --rsource -j DROP

-A INPUT -i ppp0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -m limit --limit 3/sec -j LOG --log-prefix "IPKF_flags_ALL: "

-A INPUT -i ppp0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -m limit --limit 3/sec -j LOG --log-prefix "IPKF_flags_NONE: "

-A INPUT -i ppp0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -m limit --limit 3/sec -j LOG --log-prefix "IPKF_PORTSCAN_nmap_XMAS: "

-A INPUT -i ppp0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN -m limit --limit 3/sec -j LOG --log-prefix "IPKF_PORTSCAN_nmap_FIN: "

-A INPUT -i ppp0 -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -m limit --limit 3/sec -j LOG --log-prefix "IPKF_flags_SYN_FIN: "

-A INPUT -i ppp0 -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 3/sec -j LOG --log-prefix "IPKF_flags_SYN_RST: "

-A INPUT -i ppp0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -m limit --limit 3/sec -j LOG --log-prefix "IPKF_SYN_RST_ACK_FIN_URG: "

-A INPUT -i ppp0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -m limit --limit 3/sec -j LOG --log-prefix "IPKF_PORTSCAN_nmap_NULL: "

-A INPUT -i ppp0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROP

-A INPUT -i ppp0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP

-A INPUT -i ppp0 -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP

-A INPUT -i ppp0 -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP

-A INPUT -i ppp0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP

-A INPUT -i ppp0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP

-A INPUT -i ppp0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN -j DROP

-A INPUT -i ppp0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP

-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT

-A INPUT -p tcp -m state --state INVALID -m limit --limit 3/sec -j LOG --log-prefix "IPKF_Invalid_TCP_Flag: "

-A INPUT -m state --state INVALID -j DROP

-A INPUT -i ppp0 -p icmp -m icmp --icmp-type 13 -m limit --limit 3/sec -j LOG --log-prefix "IPKF_ICMP_Timestamp: "

-A INPUT -i ppp0 -p icmp -m icmp --icmp-type 13 -j DROP

-A INPUT -i ppp0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j syn-flood

-A INPUT -i ppp0 -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -m limit --limit 3/sec -j LOG --log-prefix "IPKF_New_Not_SYN: "

-A INPUT -i ppp0 -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP

-A INPUT -i ppp0 -p tcp -m multiport --dports 137,6666 -j DROP

-A INPUT -i ppp0 -p udp -m multiport --dports 1434 -j DROP

-A INPUT -s 10.0.0.0/8 -i ppp0 -m limit --limit 3/sec -j LOG --log-prefix "IPKF_Spoof: "

-A INPUT -s 172.16.0.0/12 -i ppp0 -m limit --limit 3/sec -j LOG --log-prefix "IPKF_Spoof: "

-A INPUT -s 192.168.0.0/16 -i ppp0 -m limit --limit 3/sec -j LOG --log-prefix "IPKF_Spoof: "

-A INPUT -s 127.0.0.0/24 -i ppp0 -m limit --limit 3/sec -j LOG --log-prefix "IPKF_Spoof: "

-A INPUT -s 169.254.0.0/16 -i ppp0 -m limit --limit 3/sec -j LOG --log-prefix "IPKF_Spoof: "

-A INPUT -s 192.0.2.0/24 -i ppp0 -m limit --limit 3/sec -j LOG --log-prefix "IPKF_Spoof: "

-A INPUT -s 198.18.0.0/15 -i ppp0 -m limit --limit 3/sec -j LOG --log-prefix "IPKF_Spoof: "

-A INPUT -s 255.255.255.255/32 -i ppp0 -m limit --limit 3/sec -j LOG --log-prefix "IPKF_Spoof: "

-A INPUT -s 10.0.0.0/8 -i ppp0 -j DROP

-A INPUT -s 172.16.0.0/12 -i ppp0 -j DROP

-A INPUT -s 192.168.0.0/16 -i ppp0 -j DROP

-A INPUT -s 127.0.0.0/24 -i ppp0 -j DROP

-A INPUT -s 169.254.0.0/16 -i ppp0 -j DROP

-A INPUT -s 192.0.2.0/24 -i ppp0 -j DROP

-A INPUT -s 198.18.0.0/15 -i ppp0 -j DROP

-A INPUT -s 255.255.255.255/32 -i ppp0 -j DROP

-A INPUT -j DROP

-A FORWARD -s 192.168.1.0/24 -i eth2 -m state --state NEW -j ACCEPT

-A FORWARD -s 192.168.0.0/24 -i eth0 -m state --state NEW -j ACCEPT

-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

-A FORWARD -s 192.168.1.0/24 -o ppp0 -p udp -m state --state INVALID -j REJECT --reject-with icmp-port-unreachable

-A FORWARD -s 192.168.1.0/24 -o ppp0 -p tcp -m state --state INVALID -j REJECT --reject-with icmp-port-unreachable

-A FORWARD -s 192.168.0.0/24 -o ppp0 -p udp -m state --state INVALID -j REJECT --reject-with icmp-port-unreachable

-A FORWARD -s 192.168.0.0/24 -o ppp0 -p tcp -m state --state INVALID -j REJECT --reject-with icmp-port-unreachable

-A FORWARD -i ppp0 -m recent --rcheck --seconds 120 --name badguy --rsource -j DROP

-A FORWARD -i ppp0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -m limit --limit 3/sec -j LOG --log-prefix "IPKF_flags_ALL: "

-A FORWARD -i ppp0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -m limit --limit 3/sec -j LOG --log-prefix "IPKF_flags_NONE: "

-A FORWARD -i ppp0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -m limit --limit 3/sec -j LOG --log-prefix "IPKF_flags_FIN_URG_PSH: "

-A FORWARD -i ppp0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN -m limit --limit 3/sec -j LOG --log-prefix "IPKF_PORTSCAN_nmap_XMAS: "

-A FORWARD -i ppp0 -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -m limit --limit 3/sec -j LOG --log-prefix "IPKF_flags_SYN_FIN: "

-A FORWARD -i ppp0 -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 3/sec -j LOG --log-prefix "IPKF_flags_SYN_RST: "

-A FORWARD -i ppp0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -m limit --limit 3/sec -j LOG --log-prefix "IPKF_SYN_RST_ACK_FIN_URG: "

-A FORWARD -i ppp0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -m limit --limit 3/sec -j LOG --log-prefix "IPKF_PORTSCAN_nmap_NULL: "

-A FORWARD -i ppp0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP

-A FORWARD -i ppp0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROP

-A FORWARD -i ppp0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP

-A FORWARD -i ppp0 -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP

-A FORWARD -i ppp0 -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP

-A FORWARD -i ppp0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP

-A FORWARD -i ppp0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP

-A FORWARD -i ppp0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN -j DROP

-A FORWARD -i ppp0 -p tcp -m state --state INVALID -m limit --limit 3/sec -j LOG --log-prefix "IPKF_Invalid_TCP_flag: "

-A FORWARD -i ppp0 -m state --state INVALID -j DROP

-A FORWARD -i ppp0 -p icmp -m icmp --icmp-type 13 -m limit --limit 3/sec -j LOG --log-prefix "IPKF_ICMP_Timestamp: "

-A FORWARD -i ppp0 -p icmp -m icmp --icmp-type 13 -j DROP

-A FORWARD -i ppp0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j syn-flood

-A FORWARD -i ppp0 -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -m limit --limit 3/sec -j LOG --log-prefix "IPKF_New_Not_SYN: "

-A FORWARD -i ppp0 -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP

-A FORWARD -i ppp0 -p tcp -m multiport --dports 137,6666 -j DROP

-A FORWARD -i ppp0 -p udp -m multiport --dports 1434 -j DROP

-A FORWARD -s 10.0.0.0/8 -i ppp0 -m limit --limit 3/sec -j LOG --log-prefix "IPKF_Spoof: "

-A FORWARD -s 172.16.0.0/12 -i ppp0 -m limit --limit 3/sec -j LOG --log-prefix "IPKF_Spoof: "

-A FORWARD -s 192.168.0.0/16 -i ppp0 -m limit --limit 3/sec -j LOG --log-prefix "IPKF_Spoof: "

-A FORWARD -s 127.0.0.0/24 -i ppp0 -m limit --limit 3/sec -j LOG --log-prefix "IPKF_Spoof: "

-A FORWARD -s 169.254.0.0/16 -i ppp0 -m limit --limit 3/sec -j LOG --log-prefix "IPKF_Spoof: "

-A FORWARD -s 192.0.2.0/24 -i ppp0 -m limit --limit 3/sec -j LOG --log-prefix "IPKF_Spoof: "

-A FORWARD -s 198.18.0.0/15 -i ppp0 -m limit --limit 3/sec -j LOG --log-prefix "IPKF_Spoof: "

-A FORWARD -s 255.255.255.255/32 -i ppp0 -m limit --limit 3/sec -j LOG --log-prefix "IPKF_Spoof: "

-A FORWARD -s 10.0.0.0/8 -i ppp0 -j DROP

-A FORWARD -s 172.16.0.0/12 -i ppp0 -j DROP

-A FORWARD -s 192.168.0.0/16 -i ppp0 -j DROP

-A FORWARD -s 127.0.0.0/24 -i ppp0 -j DROP

-A FORWARD -s 169.254.0.0/16 -i ppp0 -j DROP

-A FORWARD -s 192.0.2.0/24 -i ppp0 -j DROP

-A FORWARD -s 198.18.0.0/15 -i ppp0 -j DROP

-A FORWARD -s 255.255.255.255/32 -i ppp0 -j DROP

-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

-A OUTPUT -m state --state NEW -j ACCEPT

-A syn-flood -m limit --limit 10/sec --limit-burst 24 -j RETURN

-A syn-flood -m limit --limit 3/sec -j LOG --log-prefix "IPKF_SYN_flood: "

-A syn-flood -j DROP

```

```
squid.conf

http_port 3128

icp_port 0

acl ip_acl src 192.168.1.0/24

http_access allow ip_acl

http_access deny all

#http_access allow all

cache_mem 32 MB

```

```
dansguardian.conf

# DansGuardian config file for version 2.10.0.3

# **NOTE** as of version 2.7.5 most of the list files are now in dansguardianf1.conf

# Web Access Denied Reporting (does not affect logging)

#

# -1 = log, but do not block - Stealth mode

#  0 = just say 'Access Denied'

#  1 = report why but not what denied phrase

#  2 = report fully

#  3 = use HTML template file (accessdeniedaddress ignored) - recommended

#

reportinglevel = 3

# Language dir where languages are stored for internationalisation.

# The HTML template within this dir is only used when reportinglevel

# is set to 3. When used, DansGuardian will display the HTML file instead of

# using the perl cgi script.  This option is faster, cleaner

# and easier to customise the access denied page.

# The language file is used no matter what setting however.

#

languagedir = '/usr/share/dansguardian/languages'

# language to use from languagedir.

language = 'german'

# Logging Settings

#

# 0 = none  1 = just denied  2 = all text based  3 = all requests

loglevel = 2

# Log Exception Hits

# Log if an exception (user, ip, URL, phrase) is matched and so

# the page gets let through.  Can be useful for diagnosing

# why a site gets through the filter.

# 0 = never log exceptions

# 1 = log exceptions, but do not explicitly mark them as such

# 2 = always log & mark exceptions (default)

logexceptionhits = 2

# Log File Format

# 1 = DansGuardian format (space delimited)

# 2 = CSV-style format

# 3 = Squid Log File Format

# 4 = Tab delimited

logfileformat = 1

# truncate large items in log lines

#maxlogitemlength = 400

# anonymize logs (blank out usernames & IPs)

#anonymizelogs = on

# Syslog logging

#

# Use syslog for access logging instead of logging to the file

# at the defined or built-in "loglocation"

#syslog = on

# Log file location

# 

# Defines the log directory and filename.

#loglocation = '/var/log/dansguardian/access.log'

# Statistics log file location

#

# Defines the stat file directory and filename.

# Only used in conjunction with maxips > 0

# Once every 3 minutes, the current number of IPs in the cache, and the most

# that have been in the cache since the daemon was started, are written to this

# file. IPs persist in the cache for 7 days.

#statlocation = '/var/log/dansguardian/stats'

# Network Settings

# 

# the IP that DansGuardian listens on.  If left blank DansGuardian will

# listen on all IPs.  That would include all NICs, loopback, modem, etc.

# Normally you would have your firewall protecting this, but if you want

# you can limit it to a certain IP. To bind to multiple interfaces,

# specify each IP on an individual filterip line.

filterip =

# the port that DansGuardian listens to.

filterport = 80

# the ip of the proxy (default is the loopback - i.e. this server)

proxyip = 192.168.1.1

# the port DansGuardian connects to proxy on

proxyport = 3128

# accessdeniedaddress is the address of your web server to which the cgi

# dansguardian reporting script was copied. Only used in reporting levels 1 and 2.

#

# This webserver must be either:

#  1. Non-proxied. Either a machine on the local network, or listed as an exception

#     in your browser's proxy configuration.

#  2. Added to the exceptionsitelist. Option 1 is preferable; this option is

#     only for users using both transparent proxying and a non-local server

#     to host this script.

#

# Individual filter groups can override this setting in their own configuration.

#

accessdeniedaddress = 'http://YOURSERVER.YOURDOMAIN/cgi-bin/dansguardian.pl'

# Non standard delimiter (only used with accessdeniedaddress)

# To help preserve the full banned URL, including parameters, the variables

# passed into the access denied CGI are separated using non-standard

# delimiters. This can be useful to ensure correct operation of the filter

# bypass modes. Parameters are split using "::" in place of "&", and "==" in

# place of "=".

# Default is enabled, but to go back to the standard mode, disable it.

nonstandarddelimiter = on

# Banned image replacement

# Images that are banned due to domain/url/etc reasons including those

# in the adverts blacklists can be replaced by an image.  This will,

# for example, hide images from advert sites and remove broken image

# icons from banned domains.

# on (default) | off

usecustombannedimage = on

custombannedimagefile = '/usr/share/dansguardian/transparent1x1.gif'

# Filter groups options

# filtergroups sets the number of filter groups. A filter group is a set of content

# filtering options you can apply to a group of users.  The value must be 1 or more.

# DansGuardian will automatically look for dansguardianfN.conf where N is the filter

# group.  To assign users to groups use the filtergroupslist option.  All users default

# to filter group 1.  You must have some sort of authentication to be able to map users

# to a group.  The more filter groups the more copies of the lists will be in RAM so

# use as few as possible.

filtergroups = 1

filtergroupslist = '/etc/dansguardian/lists/filtergroupslist'

# Authentication files location

bannediplist = '/etc/dansguardian/lists/bannediplist'

exceptioniplist = '/etc/dansguardian/lists/exceptioniplist'

# Show weighted phrases found

# If enabled then the phrases found that made up the total which excedes

# the naughtyness limit will be logged and, if the reporting level is

# high enough, reported. on | off

showweightedfound = on

# Weighted phrase mode

# There are 3 possible modes of operation:

# 0 = off = do not use the weighted phrase feature.

# 1 = on, normal = normal weighted phrase operation.

# 2 = on, singular = each weighted phrase found only counts once on a page.

#

weightedphrasemode = 2

# Positive (clean) result caching for URLs

# Caches good pages so they don't need to be scanned again.

# It also works with AV plugins.

# 0 = off (recommended for ISPs with users with disimilar browsing)

# 1000 = recommended for most users

# 5000 = suggested max upper limit

# If you're using an AV plugin then use at least 5000.

urlcachenumber = 1000

#

# Age before they are stale and should be ignored in seconds

# 0 = never

# 900 = recommended = 15 mins

urlcacheage = 900

# Clean cache for content (AV) scan results

# By default, to save CPU, files scanned and found to be

# clean are inserted into the clean cache and NOT scanned

# again for a while.  If you don't like this then choose

# to disable it.

# (on|off) default = on.

scancleancache = on

# Smart, Raw and Meta/Title phrase content filtering options

# Smart is where the multiple spaces and HTML are removed before phrase filtering

# Raw is where the raw HTML including meta tags are phrase filtered

# Meta/Title is where only meta and title tags are phrase filtered (v. quick)

# CPU usage can be effectively halved by using setting 0 or 1 compared to 2

# 0 = raw only

# 1 = smart only

# 2 = both of the above (default)

# 3 = meta/title

phrasefiltermode = 2

# Lower casing options

# When a document is scanned the uppercase letters are converted to lower case

# in order to compare them with the phrases.  However this can break Big5 and

# other 16-bit texts.  If needed preserve the case.  As of version 2.7.0 accented

# characters are supported.

# 0 = force lower case (default)

# 1 = do not change case

# 2 = scan first in lower case, then in original case

preservecase = 0

# Note:

# If phrasefiltermode and preserve case are both 2, this equates to 4 phrase

# filtering passes. If you have a large enough userbase for this to be a

# worry, and need to filter pages in exotic character encodings, it may be

# better to run two instances on separate servers: one with preservecase 1

# (and possibly forcequicksearch 1) and non ASCII/UTF-8 phrase lists, and one

# with preservecase 0 and ASCII/UTF-8 lists.

# Hex decoding options

# When a document is scanned it can optionally convert %XX to chars.

# If you find documents are getting past the phrase filtering due to encoding

# then enable.  However this can break Big5 and other 16-bit texts.

# off = disabled (default)

# on = enabled

hexdecodecontent = off

# Force Quick Search rather than DFA search algorithm

# The current DFA implementation is not totally 16-bit character compatible

# but is used by default as it handles large phrase lists much faster.

# If you wish to use a large number of 16-bit character phrases then

# enable this option.

# off (default) | on (Big5 compatible)

forcequicksearch = off

# Reverse lookups for banned site and URLs.

# If set to on, DansGuardian will look up the forward DNS for an IP URL

# address and search for both in the banned site and URL lists.  This would

# prevent a user from simply entering the IP for a banned address.

# It will reduce searching speed somewhat so unless you have a local caching

# DNS server, leave it off and use the Blanket IP Block option in the

# bannedsitelist file instead.

reverseaddresslookups = off

# Reverse lookups for banned and exception IP lists.

# If set to on, DansGuardian will look up the forward DNS for the IP

# of the connecting computer.  This means you can put in hostnames in

# the exceptioniplist and bannediplist.

# If a client computer is matched against an IP given in the lists, then the

# IP will be recorded in any log entries; if forward DNS is successful and a

# match occurs against a hostname, the hostname will be logged instead.

# It will reduce searching speed somewhat so unless you have a local DNS server, 

# leave it off.

reverseclientiplookups = off

# Perform reverse lookups on client IPs for successful requests.

# If set to on, DansGuardian will look up the forward DNS for the IP

# of the connecting computer, and log host names (where available) rather than

# IPs against requests.

# This is not dependent on reverseclientiplookups being enabled; however, if it

# is, enabling this option does not incur any additional forward DNS requests.

logclienthostnames = off

# Build bannedsitelist and bannedurllist cache files.

# This will compare the date stamp of the list file with the date stamp of

# the cache file and will recreate as needed.

# If a bsl or bul .processed file exists, then that will be used instead.

# It will increase process start speed by 300%.  On slow computers this will

# be significant.  Fast computers do not need this option. on | off

createlistcachefiles = on

# POST protection (web upload and forms)

# does not block forms without any file upload, i.e. this is just for

# blocking or limiting uploads

# measured in kibibytes after MIME encoding and header bumph

# use 0 for a complete block

# use higher (e.g. 512 = 512Kbytes) for limiting

# use -1 for no blocking

#maxuploadsize = 512

#maxuploadsize = 0

maxuploadsize = -1

# Max content filter size

# Sometimes web servers label binary files as text which can be very

# large which causes a huge drain on memory and cpu resources.

# To counter this, you can limit the size of the document to be

# filtered and get it to just pass it straight through.

# This setting also applies to content regular expression modification.

# The value must not be higher than maxcontentramcachescansize

# The size is in Kibibytes - eg 2048 = 2Mb

# use 0 to set it to maxcontentramcachescansize

maxcontentfiltersize = 256

# Max content ram cache scan size

# This is only used if you use a content scanner plugin such as AV

# This is the max size of file that DG will download and cache

# in RAM.  After this limit is reached it will cache to disk

# This value must be less than or equal to maxcontentfilecachescansize.

# The size is in Kibibytes - eg 10240 = 10Mb

# use 0 to set it to maxcontentfilecachescansize

# This option may be ignored by the configured download manager.

maxcontentramcachescansize = 2000

# Max content file cache scan size

# This is only used if you use a content scanner plugin such as AV

# This is the max size file that DG will download

# so that it can be scanned or virus checked.

# This value must be greater or equal to maxcontentramcachescansize.

# The size is in Kibibytes - eg 10240 = 10Mb

maxcontentfilecachescansize = 20000

# File cache dir

# Where DG will download files to be scanned if too large for the

# RAM cache.

filecachedir = '/tmp'

# Delete file cache after user completes download

# When a file gets save to temp it stays there until it is deleted.

# You can choose to have the file deleted when the user makes a sucessful

# download.  This will mean if they click on the link to download from

# the temp store a second time it will give a 404 error.

# You should configure something to delete old files in temp to stop it filling up.

# on|off (defaults to on)

deletedownloadedtempfiles = on

# Initial Trickle delay

# This is the number of seconds a browser connection is left waiting

# before first being sent *something* to keep it alive.  The

# *something* depends on the download manager chosen.

# Do not choose a value too low or normal web pages will be affected.

# A value between 20 and 110 would be sensible

# This may be ignored by the configured download manager.

initialtrickledelay = 20

# Trickle delay

# This is the number of seconds a browser connection is left waiting

# before being sent more *something* to keep it alive.  The

# *something* depends on the download manager chosen.

# This may be ignored by the configured download manager.

trickledelay = 10

# Download Managers

# These handle downloads of files to be filtered and scanned.

# They differ in the method they deal with large downloads.

# Files usually need to be downloaded 100% before they can be

# filtered and scanned before being sent on to the browser.

# Normally the browser can just wait, but with content scanning,

# for example to AV, the browser may timeout or the user may get

# confused so the download manager has to do some sort of

# 'keep alive'.

#

# There are various methods possible but not all are included.

# The author does not have the time to write them all so I have

# included a plugin systam.  Also, not all methods work with all

# browsers and clients.  Specifically some fancy methods don't

# work with software that downloads updates.  To solve this,

# each plugin can support a regular expression for matching

# the client's user-agent string, and lists of the mime types

# and extensions it should manage.

#

# Note that these are the matching methods provided by the base plugin

# code, and individual plugins may override or add to them.

# See the individual plugin conf files for supported options.

#

# The plugins are matched in the order you specify and the last

# one is forced to match as the default, regardless of user agent

# and other matching mechanisms.

#

downloadmanager = '/etc/dansguardian/downloadmanagers/fancy.conf'

##!! Not compiled !! downloadmanager = '/etc/dansguardian/downloadmanagers/trickle.conf'

downloadmanager = '/etc/dansguardian/downloadmanagers/default.conf'

# Content Scanners (Also known as AV scanners)

# These are plugins that scan the content of all files your browser fetches

# for example to AV scan.  The options are limitless.  Eventually all of

# DansGuardian will be plugin based.  You can have more than one content

# scanner. The plugins are run in the order you specify.

# This is one of the few places you can have multiple options of the same name.

#

# Some of the scanner(s) require 3rd party software and libraries eg clamav.

# See the individual plugin conf file for more options (if any).

#

#!! Not compiled !! contentscanner = '/etc/dansguardian/contentscanners/clamav.conf'

contentscanner = '/etc/dansguardian/contentscanners/clamdscan.conf'

#!! Unimplemented !! contentscanner = '/etc/dansguardian/contentscanners/kavav.conf'

#!! Not compiled !! contentscanner = '/etc/dansguardian/contentscanners/kavdscan.conf'

#!! Not compiled !! contentscanner = '/etc/dansguardian/contentscanners/icapscan.conf'

#!! Not compiled !! contentscanner = '/etc/dansguardian/contentscanners/commandlinescan.conf'

# Content scanner timeout

# Some of the content scanners support using a timeout value to stop

# processing (eg AV scanning) the file if it takes too long.

# If supported this will be used.

# The default of 60 seconds is probably reasonable.

contentscannertimeout = 60

# Content scan exceptions

# If 'on' exception sites, urls, users etc will be scanned

# This is probably not desirable behavour as exceptions are

# supposed to be trusted and will increase load.

# Correct use of grey lists are a better idea.

# (on|off) default = off

contentscanexceptions = off

# Auth plugins

# These replace the usernameidmethod* options in previous versions. They

# handle the extraction of client usernames from various sources, such as

# Proxy-Authorisation headers and ident servers, enabling requests to be

# handled according to the settings of the user's filter group.

# Multiple plugins can be specified, and will be queried in order until one

# of them either finds a username or throws an error. For example, if Squid

# is configured with both NTLM and Basic auth enabled, and both the 'proxy-basic'

# and 'proxy-ntlm' auth plugins are enabled here, then clients which do not support

# NTLM can fall back to Basic without sacrificing access rights.

#

# If you do not use multiple filter groups, you need not specify this option.

#

#authplugin = '/etc/dansguardian/authplugins/proxy-basic.conf'

#authplugin = '/etc/dansguardian/authplugins/proxy-digest.conf'

#!! Not compiled !! authplugin = '/etc/dansguardian/authplugins/proxy-ntlm.conf'

#authplugin = '/etc/dansguardian/authplugins/ident.conf'

#authplugin = '/etc/dansguardian/authplugins/ip.conf'

# Re-check replaced URLs

# As a matter of course, URLs undergo regular expression search/replace (urlregexplist)

# *after* checking the exception site/URL/regexpURL lists, but *before* checking against

# the banned site/URL lists, allowing certain requests that would be matched against the

# latter in their original state to effectively be converted into grey requests.

# With this option enabled, the exception site/URL/regexpURL lists are also re-checked

# after replacement, making it possible for URL replacement to trigger exceptions based

# on them.

# Defaults to off.

recheckreplacedurls = off

# Misc settings

# if on it adds an X-Forwarded-For: <clientip> to the HTTP request

# header.  This may help solve some problem sites that need to know the

# source ip. on | off

forwardedfor = off

# if on it uses the X-Forwarded-For: <clientip> to determine the client

# IP. This is for when you have squid between the clients and DansGuardian.

# Warning - headers are easily spoofed. on | off

usexforwardedfor = off

# if on it logs some debug info regarding fork()ing and accept()ing which

# can usually be ignored.  These are logged by syslog.  It is safe to leave

# it on or off

logconnectionhandlingerrors = on

# Fork pool options

# If on, this causes DG to write to the log file whenever child processes are

# created or destroyed (other than by crashes). This information can help in

# understanding and tuning the following parameters, but is not generally

# useful in production.

logchildprocesshandling = off

# sets the maximum number of processes to spawn to handle the incoming

# connections.  Max value usually 250 depending on OS.

# On large sites you might want to try 180.

maxchildren = 120

# sets the minimum number of processes to spawn to handle the incoming connections.

# On large sites you might want to try 32.

minchildren = 8

# sets the minimum number of processes to be kept ready to handle connections.

# On large sites you might want to try 8.

minsparechildren = 4

# sets the minimum number of processes to spawn when it runs out

# On large sites you might want to try 10.

preforkchildren = 6

# sets the maximum number of processes to have doing nothing.

# When this many are spare it will cull some of them.

# On large sites you might want to try 64.

maxsparechildren = 32

# sets the maximum age of a child process before it croaks it.

# This is the number of connections they handle before exiting.

# On large sites you might want to try 10000.

maxagechildren = 500

# Sets the maximum number client IP addresses allowed to connect at once.

# Use this to set a hard limit on the number of users allowed to concurrently

# browse the web. Set to 0 for no limit, and to disable the IP cache process.

maxips = 0

# Process options

# (Change these only if you really know what you are doing).

# These options allow you to run multiple instances of DansGuardian on a single machine.

# Remember to edit the log file path above also if that is your intention.

# IPC filename

# 

# Defines IPC server directory and filename used to communicate with the log process.

ipcfilename = '/tmp/.dguardianipc'

# URL list IPC filename

# 

# Defines URL list IPC server directory and filename used to communicate with the URL

# cache process.

urlipcfilename = '/tmp/.dguardianurlipc'

# IP list IPC filename

#

# Defines IP list IPC server directory and filename, for communicating with the client

# IP cache process.

ipipcfilename = '/tmp/.dguardianipipc'

# PID filename

# 

# Defines process id directory and filename.

#pidfilename = '/var/run/dansguardian.pid'

# Disable daemoning

# If enabled the process will not fork into the background.

# It is not usually advantageous to do this.

# on|off (defaults to off)

nodaemon = off

# Disable logging process

# on|off (defaults to off)

nologger = off

# Enable logging of "ADs" category blocks

# on|off (defaults to off)

logadblocks = off

# Enable logging of client User-Agent

# Some browsers will cause a *lot* of extra information on each line!

# on|off (defaults to off)

loguseragent = off

# Daemon runas user and group

# This is the user that DansGuardian runs as.  Normally the user/group nobody.

# Uncomment to use.  Defaults to the user set at compile time.

# Temp files created during virus scanning are given owner and group read

# permissions; to use content scanners based on external processes, such as

# clamdscan, the two processes must run with either the same group or user ID.

#daemonuser = 'clamav'

#daemongroup = 'clamav'

# Soft restart

# When on this disables the forced killing off all processes in the process group.

# This is not to be confused with the -g run time option - they are not related.

# on|off (defaults to off)

softrestart = off

# Mail program

# Path (sendmail-compatible) email program, with options.

# Not used if usesmtp is disabled (filtergroup specific).

mailer = '/usr/sbin/sendmail -t'

```

----------

## DawgG

1. pls don't post #comments in configs here.

2. keep it simple: if you are not a network forensic or a highly sophisticated network manager you probably do not need so many LOG or REJECT --with ... rules in iptables

3. if you want to "share" your "public" ip-address to your internal private network(s) you need nat with MASQUERADE for internet access

4. for squid/dansguardian you don't need iptables at all; just configure it to listen only on the internal interface and get content via the external interface. of course it is possible to run it on the firewall/nat-box with iptables, you just have set iptables-rules accordingly

5. this squid.conf is grossly incomplete; you can use most of the example config to get it running and then optimize it. you can use 

```
squid -k parse
```

 to check its syntax; 

```
squid -k reconfigure
```

 to load new settings into a running instance

before the first start you have to run 

```
squid -z
```

 to create the cache-directories (whose definition is missing in the squid.conf you posted)

6. when squid runs satisfactorily you can configure dansgardian (which is a kind of addon to squid). it receives requests on a port (network socket), processes them and forwards the result to squid. squid can (should) then be configured to listen only on 127.0.0.1 so users cannot circumvent dansguardian.

GOOD LUCK!

----------

