Re: Using Squid

neil.bosh@xxxxxxxxx wrote:
hi, can anyone help me with answering the following questions about the
way we can use squid. I have read some online material about squid but
I am getting mixed answers to these problems.

1. Can we control Telnet, FTP and SSH access using squid
2. Deny ICMP packets, namely ping
3. Reject traffic coming to the UDP ports
4. Block email coming in and out of network
5. block traffic from a particular netwok

I know we can accomplish this using iptables in linux, but what about
squid, can it be configured to control the above packets or application
and if not, what is the reason behind it.

The reason is that's not what Squid was designed to do. (Those things are precisely what iptables was designed for, however.)

Squid is a caching proxy, not a firewall. It fetches and stores local copies of documents retrieved by HTTP, HTTPS, or FTP and then serves the local copy (instead of fetching across the Internet again) the next time somebody requests that same file. That's all it does. (And that's something that iptables is totally incapable of doing. They perform drastically different tasks. They work very well together.)

Squid doesn't listen for telnet/ssh connections, it doesn't listen for ICMP packets, it doesn't listen on UDP ports, it doesn't listen for mail traffic. To control those things, you need a firewall (iptables being the most common).

For definitive information, see the Squid website at http://www.squid-cache.org/ Ask on their mailing list if you want to clarify any of the "mixed answers" you say you've gotten.
.

Relevant Pages

  • Re: IP masquerading: squid or iptables?
    ... If u use squid as a proxy, your client connects to the proxy-server, which in turn establishes a new connection to the internet. ... This is independent of iptables. ...
    (alt.os.linux.redhat)
  • Re: Squid - transparent proxy + apache
    ... I configured Squid to be a transparent ... I put the rules needed in my iptables config, ... machine as the transparent proxy, because with iptables I redirect al ...
    (Fedora)
  • Re: Squid with Dansguardian problem.
    ... Invalid URL Error page is squid error page that i see on the web browser. ... I think,it means web request is being redirected to dansguardian by iptables ... echo " External interface: $EXTIF" ...
    (Debian-User)
  • Re: header filter !
    ... I suggest using iptables as a firewall / router. ... Use squid as proxy, and configure porn filters in squid. ...
    (comp.security.firewalls)
  • Re: iptables+squid+dhcp+USER_AUTHENTICATION
    ... >iptables (for transparent proxy and to route non-http traffic) ... >if i only use squid then i can provide user authentication, ... requires the extra control. ...
    (comp.os.linux.security)