Linux as a Proxy Server

How do you keep unwanted visitors out of your network while still giving your users the Internet access they rely on? The answer is a firewall equipped with a proxy server.

Proxy servers are software applications that run on your firewall machine in order to provide indirect Internet access to your network. The firewall can be either a “single-homed” host or a “dual-homed” host. A single-homed host is a machine with one network card. This configuration relies on the Internet router to block all packets to any machine except the firewall. A dual-homed host is a machine with two network cards that has routing capabilities disabled. Computers behind the firewall can talk to the dual-homed host, and computers on the Internet can communicate with the dual-homed host. However, since routing between the network cards is disabled, the computers behind the firewall cannot talk directly to the computers on the Internet.

The proxy server is used to allow Internet access from inside the protected network through either the single or dual-homed host firewall. The client applications speak directly to the proxy server and the proxy server in turn speaks directly to the Internet hosts on behalf of the client, thusacting as a proxy. This interaction allows Internet access to all clients on the internal network, but leaves only one machine, the firewall, directly vulnerable to attacks from the Internet.

The proxy server takes a packet from inside your network that is bound for the Internet and changes the “from” address to its own address. It then forwards the packet to the destination host. The beauty of the proxy server is that the destination host thinks it is talking only to the firewall. When the firewall receives the response from the destination host, the proxy server sends the packet back to the original requesting machine. The client has the illusion that it has been communicating directly with the host on the Internet. The host on the Internet has the illusion that it is only dealing with the firewall.

This method is a big advantage when you access FTP sites that do double-reverse lookups. These sites, as a security measure, want to ensure you are truly coming from the address you've given. The host name of the requesting IP address is looked up in the DNS records. The server then does a lookup of the host name it received. If the IP address it receives from this last lookup does not match the requesting one or if the DNS lookup failed to find any entries, the server denies access.

If you are denied access to one of these sites, there is most likely a problem with your DNS setup. When you have to manage several machines across your network, keeping all the entries up to date can be a daunting task. With a proxy server in place, your entire network appears to come from the IP address of the proxy server, thus reducing the total number of properly configured DNS entries you need.

Another advantage of using a proxy server is that since all outbound traffic must pass through the firewall, as an administrator, you can monitor which types of Internet activity are occurring. The proxy server has very robust logging capabilities which allow you to see who is accessing what on the Internet. Attempted access from the outside is also logged closely.

Setting up the Linux box

I will not go into the details of setting up a packet-filtering router, since that type of information is vendor specific. However, I will give you the basic information on setting up a dual-homed host firewall. Assuming you use a Linux machine for your host, you will need to have two network cards installed in your machine. Read the “Multiple-Ethernet” mini-HOWTO located at ftp://sunsite.unc.edu/. I used two 3Com509 cards.

Auto-sensing the modules to load is a common problem when using two identical cards, so I compiled the drivers into a monolithic kernel instead of a modular one. I also added the following line to my /etc/lilo.conf file:

append="ether=11,0x300,eth0 ether=10,0x270,eth1"

This ensures that the proper parameters are passed at boot time.

Configure your kernel to keep it from routing IP packets (see Listing 1). To further ensure protection and anonymity, use one of the “bogus” class addresses (see Table 1) as per RFC1918. These IP addresses are set aside by the INTERNIC for use behind a firewall. Any packet with one of these IP addresses is dropped by the Internet backbone routers. See Figure 1 for an example of a network topology with a dual-homed host firewall. The example configuration files in this article are based on this basic topology. Our protected network is assigned the “bogus” Class C address 192.168.50, and we assume that the valid IP address of the Internet side of the firewall is 111.222.333.1.

Listing 1

Table 1

Figure 1. Dual-homed Host Firewall

______________________

Comments

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

i configure squid proxy

Anonymous's picture

i configure squid proxy server, it work propely but my client could not able to download more than 20mb size video file. please help me and give me a solution.

http://www.linuxjournal.com/f

Anonymous's picture

about proxy through squid

reena ahuja's picture

i configure linux proxy server through squid.but i install windows XP in my client pc.
And 1 error comes access denied.i configure proper ACl in squid.conf.so please solve my problem as early as possible.

linx as web server

Anonymous's picture

we want to setup a linux web server with clients windows. Kindly advise us ,
If the modem ip assigned is 192.168.6.100
then will it work this way
etho – which is connected to modem (the external card) – 192.168.6.1
Default gateway -192.168.6.100
eth1 – which is connected to network (motherboard card) – 192.168.7.1
eth1:1 – which is virtual lan - 192.168.6.2
Default gateway – 192.168.6.1 for eht1 & eth1:1

& the windows xp ip will be 192.168.6.x
with default gateway as192.168.6.1
& in internet explorer tools  internet options  connections  192.168.6.1 with port 3128

proxy

Anonymous's picture

It became useful first to distinguish among different kinds of IP vpn based on the administrative relationships, not the technology, interconnecting the nodes. Once the relationships were defined, different technologies could be used, depending on requirements such as security and quality of service.

Re: Linux as a Proxy Server

Anonymous's picture

the solution was good. but iam using squid as my proxy server so icouldn,t get benifitted. if you can sent me some ideas about squid i would be really thankfull.

mail venkat02k2@yahoo.com

Squid with Firewall

Rayudu's picture

Please use Shorewall as your firewall. This is basically a iptables wraper software making the deadly iptables easier. You can drop all the Ipnos you do't want. They will not reach your server more so your squid.

With best Wishes,

Rayudu, Machilipatnam, India.

White Paper
Linux Management with Red Hat Satellite: Measuring Business Impact and ROI

Linux has become a key foundation for supporting today's rapidly growing IT environments. Linux is being used to deploy business applications and databases, trading on its reputation as a low-cost operating environment. For many IT organizations, Linux is a mainstay for deploying Web servers and has evolved from handling basic file, print, and utility workloads to running mission-critical applications and databases, physically, virtually, and in the cloud. As Linux grows in importance in terms of value to the business, managing Linux environments to high standards of service quality — availability, security, and performance — becomes an essential requirement for business success.

Learn More

Sponsored by Red Hat

White Paper
Private PaaS for the Agile Enterprise

If you already use virtualized infrastructure, you are well on your way to leveraging the power of the cloud. Virtualization offers the promise of limitless resources, but how do you manage that scalability when your DevOps team doesn’t scale? In today’s hypercompetitive markets, fast results can make a difference between leading the pack vs. obsolescence. Organizations need more benefits from cloud computing than just raw resources. They need agility, flexibility, convenience, ROI, and control.

Stackato private Platform-as-a-Service technology from ActiveState extends your private cloud infrastructure by creating a private PaaS to provide on-demand availability, flexibility, control, and ultimately, faster time-to-market for your enterprise.

Learn More

Sponsored by ActiveState