Dansguardian Content Filtering With Transparent Proxy On Ubuntu 9.10 Karmic
This tutorial explains how you can add content filtering to an existing Ubuntu 9.10 system, and how you can prevent users from bypassing the filtering system. We will use Dansguardian content filtering to set up a transparent proxy.
Objectives:
1. Add content filtering to an existing Ubuntu system.
2. Prevent users from bypassing the filtering system.
Software:
Open a terminal and type:
user@system:~$ sudo apt-get install iptables dansguardian squid
Configuration:
1. Squid
Open a terminal and type:
user@system:~$ sudo gedit /etc/squid/squid.conf
Change this line:
http_port 3128
to
http_port 3128 transparent
Save the file, then open a terminal and type:
user@system:~$ sudo /etc/init.d/squid restart
2. Dansguardian
Open a terminal and type:
user@system:~$ sudo gedit /etc/dansguardian/dansguardian.conf
Change this line:
UNCONFIGURED
to:
#UNCONFIGURED
Save file then open a terminal and type:
user@system:~$ sudo /etc/init.d/dansguardian start
3. Test Proxy
Open Firefox.
Go to http://tits.com or any other known bad site.
The site should display.
Now in Firefox select:
Edit > Preferences > Advanced > Connection > Settings
Select Manual proxy configuration.
In the HTTP Proxy box type: 127.0.0.1 Port: 8080
Place a check in the box labeled Use this proxy server for all protocols.
Click OK then Close.
Go to http://google.com and Google should be displayed. Click Refresh and verify it's still working.
Go to http://tits.com or any other known bad site.
The site should show as blocked. You may have to hit refresh for this to work.
At this point, the proxy is working.
Now in Firefox select:
Edit > Preferences > Advanced > Connection > Settings
Select No proxy.
Click OK then Close.
4. Test iptables
iptables is the firewall for Ubuntu. If you are using a firewall front end such as shorewall, etc. then you will have to adapt the concept below to your particular configuration. On a clean install of Ubuntu, this will work as written.
Open a terminal and type:
user@system:~$ sudo iptables -t nat -A OUTPUT -p tcp -m owner ! --uid-owner proxy --dport 80 -j REDIRECT --to-port 8080
This tells the firewall that outgoing web requests that are made by anyone other than the proxy should be redirected to the proxy
Open Firefox:
Go to http://tits.com or any other known bad site.
The site should show as blocked. If so, the firewall is correctly configured as a transparent proxy.
Now, to make the changes permanent:
Open a terminal and type:
user@system:~$ sudo gedit /etc/init.d/tproxy
Add this line:
iptables -t nat -A OUTPUT -p tcp -m owner ! --uid-owner proxy --dport 80 -j REDIRECT --to-port 8080
Save and exit.
Issue this command to make the file executable:
user@system:~$ sudo chmod a+x /etc/init.d/tproxy
Issue this command to make the above script run at startup:
user@system:~$ sudo update-rc.d tproxy
That's it.
