4

I installed squid on a fresh CentOS 5.5 and added this rule for iptables:

-A RH-Firewall-1-INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp --dport 8080 -j ACCEPT

Using this HOWOT: http://www.cyberciti.biz/tips/howto-rhel-centos-fedora-squid-installation-configuration.html

But clients couldn't access internet through proxy.

I tried connecting to port 8080 using telnet and it was unsuccessful.So I tried disabling iptables on the proxy server and everything worked fine.

So iptables refuses connection to squid port.

How can I fix this?Is there any problem with the rule?

Edit

Output of iptables -L -n -v:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   21  2802 RH-Firewall-1-INPUT  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 RH-Firewall-1-INPUT  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT 23 packets, 2805 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain RH-Firewall-1-INPUT (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    8   560 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           icmp type 255 
    0     0 ACCEPT     esp  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     ah   --  *      *       0.0.0.0/0            0.0.0.0/0           
   12  2093 ACCEPT     udp  --  *      *       0.0.0.0/0            224.0.0.251         udp dpt:5353 
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:631 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:631 
    1   149 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22 
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW,RELATED,ESTABLISHED tcp dpt:8080
user9517
  • 115,471
  • 20
  • 215
  • 297
Pedram
  • 143
  • 6

1 Answers1

6

Your rule has been added to the end of the existing RH-Firewall-1-INPUT chain and as such is after the blanket reject rule.

Edit the file again and put your 

-A RH-Firewall-1-INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp --dport 8080 -j ACCEPT

rule above the 

-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
user9517
  • 115,471
  • 20
  • 215
  • 297