Topic: firewall rules

[yscheung]

Hello,
I want to setup a sme server as company gateway/firewall . for the company policy, only few people can access internet , how can i setup the iptables rules in SME server 6.0.1-01??


thanks,
Jack.

[allun]

Hey dude,

so you want to restrict who can and cannot access the internet from behind your server?

Try this contrib:

http://vanhees.homeip.net/modules.php?op=modload&name=Downloads&file=index&req=viewdownloaddetails&lid=136&ttitle=e-smith-squid-restrict-ip-0.1-1.noarch.rpm

Works great for me!

[raem]

...or try Dansguardian which can do a whole lot more as well.
http://mirror.contribs.org/smeserver/contribs/rmitchell/smeserver/howto/dansguardian%20instal%20&%20configure%20HOWTO%20for%20sme%20server.htm

[yscheung]

Hello,

Thank you for your suggestion . The squid modules is very useful for me , but when the user disable the proxy setiing in their internet brower, they still can access the internet..

For example : my local network is 192.168.0.0/24
the IP range from 192.168.0.1-10 can fully access the internet , the IP range 192.168.0.11-20 can only use the ftp protocal, and the 192.168.0.21-30 can access the 216.109.127.60 (mail.yahoo.com) only .

It's easy when use a iptables scrip . Is that has a iptables modules like squid modules can do this setting?

Thanks,
Jack.

[p-jones]

You need to set a policy for your users so they cannot modify the browser settings !!!!

[yscheung]

Hi
I know . I want to setup in the fireall and in the server-manager page.

Thanks,
Jack.

[p-jones]

You cannot setup a browser policy in the server and firewall page. If you are using IE6 you need to look at the IE6 admin kit then work out how you are going to push the policy out to your users.

[dmac]

Have you tried the IP BLock by ALoveless?

http://mirror.contribs.org/smeserver/contribs/aloveless/contribs/ipblock_inet/

It will set up a link on your Server-Manager web page and will allow you to block based on IP Address.  You can set the time frame to block or just block all the time.

I have been using for about 6 months and it works well.

The interface is a bit clunky, as you will need to set a  block for an IP for each day or time frame you are interested in.

THT,

Darin

[yscheung]

Thank very much

Regards,
Jack