Firewall/router giving me fits using linux.

[Grminalac]

Hey,
I am practically pulling my hair out trying to figure out why my setup is not working correctly. I have a Mandrake-Linux 8.2 (have tried 9.0 as well) box serving as a Proxy/Firewall/Router. I am using squid as my proxy and it works great, however I am unable to configure Outlook to use my proxy settings. (even though it lies and says it uses the same settings as I.E.) So I applied a IP MASQ (manually to the IP Tables and also tried using guidedog as well) and I installed Guarddog, a fairly easy to use firewall to control access. However I am getting mixed results. I am able to get email, but only intermittantly, sometimes it will work for hours and then quit with no reason whatsoever. There appears to be no reasonable explanation as to why the setup stops working, I am making no changes, and it is not an ISP problem as I have two cable modems using the same ISp and the one plugged directly into my laptop will works without a hitch. Also I have noticed 2 computers side by side might flip flop between able to recieve mail and not. It makes no sense. I went so far as to blow the IP MASq wide open with no security or access controlls in the squid and this problem still occurs. Everything is configured correctly. I haved used squid for over a year with no problem whatsoever, now however now I get intermittant squid responses that it is unable to resolve DNS. When I shut the firewall off and restart it corrects the problem...
Does anyone know if there is a special method of applying an IP MASQ to IP tables so that it remains stable with a firewall running, also I would consider other methods such as a different linux firewall.

I had used an IP masq using IP CHains previously it worked, but found it not to be as secure. I had some romanian visitors.

Thanks,

 

[FUBAR]

May I ask why you're using both squid and iptables? I know IP tables works just great by itself but can't comment on squid. Perhaps try just tables? Perhaps also post your ruleset and we can see if something is amiss.

 

[Grminalac]

Squid works really well, I use in in conjunction with a program called sarg which easily displays what websites users goto and is really easy to set up ACl lists that control access to sites, and block sites that contain pornographic material. Also Squid is really easy to regulate via webmin, which makes my job easier.
I'll see about posting my ruleset...

I would actually have no problem opeining up the Ip masq completely with no protection and tightening down access with the firewall program; however, I'm not 100% sure how to do this.

I'm just really confused about the irregularities, I have never seen a problem that is intermittant like this.

 

[gaidin123]

I was a little confused reading your post...

Squid is just a web/ftp proxy server isn't it? What is the purpose of proxying Outlook exactly?

Have you tried disabling proxying on Outlook and verified that it works fine? If you are using the full Outlook client with an Exchange server setup the client and server do some counter-intuitive port negotiating that makes firewalling the Exchange server hard (and firewalling the client on a different net from the server may also be hard but I've never done that).

As I recall from playing with firewalling Exchange and Outlook, either the client, or the server, or both count up sequentially within a range the port(s) that they open for communicating. Perhap your iptables setup blocks out some of this range? When you said that iptables was wide open during some of your testing were the Outlook/Squid rules the only things in there?

Without knowing more I can't think of anything else to try other than changing your iptables policies to default allow and allow everything (disable catchall deny rules).

Also, are you saying that your firewall/proxy solution worked in the past up until the point when you switched your firewall over from ipchains and the 2.2 kernel to iptables with the 2.4 kernel?

Gaidin