Route only specific IP addresses to proxy server

Post new topic   Reply to topic    DD-WRT Forum Index -> Advanced Networking
View previous topic :: View next topic  
Author Message
prupert
DD-WRT Novice


Joined: 15 Sep 2010
Posts: 9
PostPosted: Thu Dec 24, 2015 10:46    Post subject: Route only specific IP addresses to proxy server Reply with quote
Hi

I've got a "transparent" proxy successfully set up on a DD-WRT router that sends all port 80 traffic to the proxy, using the default proxy firewall script from the dd-wrt wiki.

I want to modify the script, so it only redirects specific IP addresses to the proxy and lets all other IP addresses through as normal.

I've done lots of googling and came across this, which appears to do the reverse of what I want (it allows specific IP addressses through and redirects everything else to the proxy):

Code:
#!/bin/sh
iptables -t nat -N Proxy
# --Begin Host Exceptions-- 192.168.1.0/28
iptables -t nat -A Proxy -i br0 -s 192.168.1.5 -j RETURN
iptables -t nat -A Proxy -i br0 -s 192.168.1.22 -j RETURN
# --End Host Exceptions--
iptables -t nat -A Proxy -i br0 -p tcp --dport 80 -j DNAT --to 192.168.1.5:8080
iptables -t nat -A PREROUTING -i br0 -s 192.168.1.0/24 -d 192.168.1.0/24 -p tcp --dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -i br0 -s 192.168.1.0/24 -d ! 192.168.1.0/24 -p tcp --dport 80 -j Proxy
iptables -t nat -A POSTROUTING -o br0 -s 192.168.1.0/24 -p tcp -d 192.168.1.5 -j SNAT --to 192.168.1.1
iptables -t filter -I FORWARD -s 192.168.1.0/24 -d 192.168.1.5 -i br0 -o br0 -p tcp --dport 8080 -j ACCEPT


Since I have lots of IP addresses I want to bypass the proxy and only two IP addresses I want to send to the proxy, it'd be more sensible to do the reverse of the script, so it specifies those that are sent to the proxy only.

The only problem is, even aafter googling, I don't understand how to achieve this. Can any one help?

FYI, the usercase is, I have two kids (3 & 5) who are about to get (tomorrow!) some old tablets and I will be using privoxy and e2guardian to filter their web traffic. I know eventually they can spoof their IP address to bypass the proxy, but that is a problem to face in 5 years Wink

Oh and merry christmas.
Back to top View user's profile Send private message
Sponsor
prupert
DD-WRT Novice


Joined: 15 Sep 2010
Posts: 9
PostPosted: Thu Dec 24, 2015 20:29    Post subject: Reply with quote
Many thanks for the response. To confirm, the set up is currently working using the following script - sending ALL traffic to the proxy for ALL IP addresses:

Code:
#!/bin/sh
PROXY_IP=192.168.1.10
PROXY_PORT=3128
LAN_IP=`nvram get lan_ipaddr`
LAN_NET=$LAN_IP/`nvram get lan_netmask`

iptables -t nat -A PREROUTING -i br0 -s $LAN_NET -d $LAN_NET -p tcp --dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -i br0 ! -s $PROXY_IP -p tcp --dport 80 -j DNAT --to $PROXY_IP:$PROXY_PORT
iptables -t nat -I POSTROUTING -o br0 -s $LAN_NET -d $PROXY_IP -p tcp -j SNAT --to $LAN_IP
iptables -I FORWARD -i br0 -o br0 -s $LAN_NET -d $PROXY_IP -p tcp --dport $PROXY_PORT -j ACCEPT


The wiki states I can then use the following code to allow a specific IP address through:
Code:
iptables -t nat -I PREROUTING -i br0 -s [IPADDRESS] -j ACCEPT


However, this seems kinda impractical as I have around 15 IP addresses I want to allow through and only 2 I definitely want to send on to the proxy.

Moderator note 09.01.21: Edited wrong syntax thanks to the following thread: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=330134
Back to top View user's profile Send private message
prupert
DD-WRT Novice


Joined: 15 Sep 2010
Posts: 9
PostPosted: Thu Dec 24, 2015 22:58    Post subject: Reply with quote
Hi - so, from what I see, I simply use -s to specify the source IP addresses for the two machines in question. Awesome, I'll give it a whirl, many thanks and merry xmas Wink
Back to top View user's profile Send private message
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum