Dansguardian Content Filtering With Transparent Proxy On Ubuntu 9.10 Karmic

This tutorial explains how you can add content filtering to an existing Ubuntu 9.10 system, and how you can prevent users from bypassing the filtering system. We will use Dansguardian content filtering to set up a transparent proxy.

Objectives:

1. Add content filtering to an existing Ubuntu system.
2. Prevent users from bypassing the filtering system.

Software:

Open a terminal and type:

[email protected]:~$ sudo apt-get install iptables dansguardian squid

Configuration:

1. Squid

Open a terminal and type:

[email protected]:~$ sudo gedit /etc/squid/squid.conf

Change this line:

http_port 3128

http_port 3128 transparent

Save the file, then open a terminal and type:

[email protected]:~$ sudo /etc/init.d/squid restart

2. Dansguardian

Open a terminal and type:

[email protected]:~$ sudo gedit /etc/dansguardian/dansguardian.conf

Change this line:

UNCONFIGURED

to:

#UNCONFIGURED

Save file then open a terminal and type:

[email protected]:~$ sudo /etc/init.d/dansguardian start

3. Test Proxy

Open Firefox.

Go to http://tits.com or any other known bad site.

The site should display.

Now in Firefox select:

Edit > Preferences > Advanced > Connection > Settings

Select Manual proxy configuration.

In the HTTP Proxy box type: 127.0.0.1 Port: 8080
Place a check in the box labeled Use this proxy server for all protocols.

Click OK then Close.

Go to http://google.com and Google should be displayed. Click Refresh and verify it's still working.

Go to http://tits.com or any other known bad site.

The site should show as blocked. You may have to hit refresh for this to work.

At this point, the proxy is working.

Now in Firefox select:

Edit > Preferences > Advanced > Connection > Settings

Select No proxy.

Click OK then Close.

4. Test iptables

iptables is the firewall for Ubuntu. If you are using a firewall front end such as shorewall, etc. then you will have to adapt the concept below to your particular configuration. On a clean install of Ubuntu, this will work as written.

Open a terminal and type:

[email protected]:~$ sudo iptables -t nat -A OUTPUT -p tcp -m owner ! --uid-owner proxy --dport 80 -j REDIRECT --to-port 8080

This tells the firewall that outgoing web requests that are made by anyone other than the proxy should be redirected to the proxy

Open Firefox:

Go to http://tits.com or any other known bad site.

The site should show as blocked. If so, the firewall is correctly configured as a transparent proxy.

Now, to make the changes permanent:

Open a terminal and type:

[email protected]:~$ sudo gedit /etc/init.d/tproxy

Add this line:

iptables -t nat -A OUTPUT -p tcp -m owner ! --uid-owner proxy --dport 80 -j REDIRECT --to-port 8080

Save and exit.

Issue this command to make the file executable:

[email protected]:~$ sudo chmod a+x /etc/init.d/tproxy

Issue this command to make the above script run at startup:

[email protected]:~$ sudo update-rc.d tproxy

That's it.

http://www.tranquilpenguin.com

view as pdf | print

Share this page:

14 Comment(s)

Add comment

Comments

By: Anonymous

Correct line in Squid to match your setup is "http_port 8080 transparent"

By: Anonymous proxy

Actually the configuration is correct. The port 8080 is used by Dansguardian whom forwards traffic to squid on 3128. All clients are connected to 8080 by iptables rules.

By: Overcast

Confirmed, that port is for the 'backend' of dansguardian to talk to squid, then the users hit 8080 through dansguardian - this works, as is perfectly on Ubuntu 9.04 and Ubuntu 9.10

By: Tom

Works perfect on Ubuntu Server 11.10 - Thanx ;-)

By: Osprey

Um... I've been doing this setup for customers for a while... the doc works for me as written. Here is one issue I do have, however:

If you go to google videos you can view pron there as long as it's portaled through them. How can I stop it :(

By: oatkinson

The last command needs to be changed to

sudo update-rc.d tproxy defaults

The latest version seems to require the defaults parameter. When I get a chance I am going to write a script that does all of this automatically but I have to get the search and replaces right. I will post it here when I get it done. Thanks for this great resource, it has saved me tons of time.

By: Anonymous

I finished the shell script I mentioned in my last comment. I can't see how to add a link so here is the url: http://docs.google.com/leaf?id=0B7_pLr7oL6x2ODQ2YmRlMjctMzBiNy00MWI3LWI0YzgtNzJiMjJhYTQ1YmVj&hl=en just download and save to a directory then type: sudo bash dansguardian-transparent-config.sh I discuss it a little more on my blog. http://waytolinux.blogspot.com/2010/03/setting-up-dansguarian-parental-filter.html

By: Paul

Any tricks to stop users changing their proxy settings to local port 3128 ?

By: Phil

Bit of a late reply but...

If your proxy machine is remote from the desktop using it you can simply block access to port 3128 from anything other than the localhost so thats quite simple.

You post implies you're using this squid & dansguardian on the same machine from which browsing is taking place.

In that scenario I can confirm, if you only set up the iptables rule above and set proxy in browser to 127.0.0.1 3128 it bypasses dansguardian.

The solution is to add the following iptables rule:

iptables -t filter -A OUTPUT --protocol tcp --dport 3128 -m owner ! --uid-owner dansguardian -j REJECT

This adds a packet filter that says, if any packet is sent to destination port 3128 and it is NOT owned by dansguardian then reject it. In short, a normal user trying to connect to squid directly on localhost gets rejected where as the dansguardian user is permitted.

By: Feanor

I've gone through the article step by step, and everything seems to work except for the last step: when I type I've gone through the article step by step, and everything seems to work except for the last step: when I type "sudo iptables -t nat -A OUTPUT -p tcp -m owner ! --uid-owner proxy --dport 80 -j REDIRECT --to-port 8080" it doesn't block the page like it did when I manually entered the proxy info (if it helps, when I entered the proxy info in Firefox, I had to use my server's ip address instead of 127.0.0.1).

Great article by the way, I hope to get my proxy server working soon!

Ben

By: Joseph John

Thanks for the tutorial.

I tried it, but I found that it works fine if you browse from the local machine where squid and dansguard installed, from the other machine, it does not work

By: Karl

This is not a "transparent proxy"! In a transparent proxy you do not need to adjust the browsers on the workstations, just put dansguardian and squid on the gw server to you network and then point internal servers to that IP as their default route and ALL port 80 traffic is routed to that server and cannot avoid dansguardian. The users don't have access to the gateway box and must access from a workstation. That's what the mean when they say "Transparent".

By: Guru

After IP table change, even google stopped working.

Please help

By: superkid

after setting up even google is not working anymore, any guide for ubuntu 14.04?

Log in or Sign up

On this page