Homework na iptables & proxy

Passerelles Numériques Cambodia – PO box 511 Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla)Sangkat St. 371, Phum Tropeang Chhuk (Borey Sorla) TekTek Thla, Khan Sen Penh Sangkat Thla, Khan SenSok, Sok,Phnom Phnom Penh infor@cistrain.org – –(+855 83 infor@cistrain.org (+85523) 23) 99 99 83 83 83 www.kh.passerellesnumeriques.org info.cambodia@passerellesnumeriques.org

Email: satvannai@gmail.com http://khmer-free9.blogspot.com

1

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

Infrastructure

2

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

Contents I.

Server ................................................................................................................................................................. 4 A.

Proxy/Firewall Server Can access internet ...................................................................................................... 4

B.

LAN Server can ping to Proxy/Firewall Server ................................................................................................ 7

C.

LAN Server can remote to Proxy/Firewall Server .......................................................................................... 13

D.

LAN Server can access to Internet without using Proxy Server ...................................................................... 14

E.

Local DNS Server requests DNS From ISP.................................................................................................... 17

II.

Client ................................................................................................................................................................ 20 F.

LAN-client Get IP address automatically from DHCP Server......................................................................... 20

G.

LAN-client requests DNS from Local DNS Server ........................................................................................ 21

H.

IP address from 10.20.xxx.1 can access internet without using proxy ............................................................. 21

I.

LAN-client IP from 10.20.xxx.2 - 10.20.xxx.253/24 have to use proxy for accessing Internet by blocking: .... 21 a.

Block website ............................................................................................................................................ 21

b.

Block download extension (.mp3, .mp4, .exe) ............................................................................................ 21

c.

All Client can access any website beside of working time .......................................................................... 21

d. Allow LAN client access to website by authentication use from Domain controller. ...... 21 e.

Make sure clients cannot access websites that not good on squidguard and shallalist

file. 21 f.

Allow LAN client can access any websites beside of working time by allowing on

squidguard service. .................................................................................................................................... 21

3

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

Working time: 7:30-11:30 and 1:00-5:00 from Monday to Friday.

Requirement:

I.

Server A. Proxy/Firewall Server Can access internet

4

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

5

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

6

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

B. LAN Server can ping to Proxy/Firewall Server

7

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

8

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

9

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

10

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

11

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

12

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com C. LAN Server can remote to Proxy/Firewall Server

13

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

D. LAN Server can access to Internet without using Proxy Server

14

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

15

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

16

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com E. Local DNS Server requests DNS From ISP

17

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

18

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

19

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

II.

Client F. LAN-client Get IP address automatically from DHCP Server

20

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

21

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

22

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

G. LAN-client requests DNS from Local DNS Server

23

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

H. IP address from 10.20.xxx.1 can access internet without using proxy

I. LAN-client IP from 10.20.xxx.2 - 10.20.xxx.253/24 have to use proxy for accessing Internet by blocking:

24

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

25

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

a. Block website

26

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com b. Block download extension (.mp3, .mp4, .exe)

c. All Client can access any website beside of working time

d. Allow LAN client access to website by authentication use from Domain controller.

27

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

28

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

29

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

30

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

31

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

32

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

33

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

e. Make sure clients cannot access websites that not good on squidguard and shallalist file.

34

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

35

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

36

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

37

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

38

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

f. Allow LAN client can access any websites beside of working time by allowing on squidguard service.

39

Email: satvannai@gmail.com

Passerelles Numériques Cambodia – PO box 511 St. 371, Phum Tropeang Chhuk (Borey Sorla) Sangkat Tek Thla, Khan Sen Sok, Phnom Penh infor@cistrain.org – (+855 23) 99 83 83

http://khmer-free9.blogspot.com

40