Doing a port forward on all LAN IPs, EXCEPT certain IPs

[Ravenlost]

Hello,

I'm running OpenWrt 18.06.4 along with Tinyproxy 1.8.3-2.

I'm using tinyproxy to block access to certain websites. To do so, once my tinyproxy was up and running, I needed to add the following rule so that my router (192.168.2.1) would forward along all HTTP (80) requests through tinyproxy. My rule is as follows:

config redirect
	option src 'lan'
	option proto 'tcp'
	option src_dport '80'
	option src_dip '!192.168.2.1'
	option dest_ip '192.168.2.1'
	option dest 'lan'
	option dest_port '8118'
	option name 'HTTP Transparent Proxy'

Strangly enough, I have 2 softwares that seems to fail their web requests because of this portforward/tinyproxy. For exemple, Eclipse IDE would fail when trying to connect to the plugin page, etc.

If I disable the port-forward rule, they seem to work.

I'm thinking a quick fix for this would be to make ALL LAN IPs go through the port-forward, except 2 or three given IPs (MAC Address would be better but not essential). They would be the IPs of my own desktops (and not my family's PC for instance :P)

Is this possible ? If this is required, here is my tinyproxy config:

config tinyproxy
	option User 'nobody'
	option Group 'nogroup'
	option Timeout '600'
	option Filter '/etc/tinyproxy.filter'
	option DefaultErrorFile '/usr/share/tinyproxy/default.html'
	option StatFile '/usr/share/tinyproxy/stats.html'
	option StatHost 'router' # add this hostname to /etc/hosts with server's IP 
	option MaxClients '100'
	option MinSpareServers '5'
	option MaxSpareServers '20'
	option StartServers '10'
	option MaxRequestsPerChild '0'
	option FilterExtended '1'
	option FilterURLs '1'
	option PidFile '/var/run/tinyproxy.pid'
	list ConnectPort '443'
	list ConnectPort '563'
	option Listen '192.168.2.1'
	option Port '8118'
	option enabled '1'
	option LogFile '/var/log/tinyproxy.log'
	option LogLevel 'Info'
	list Allow '192.168.2.0/24'
	list Allow '127.0.0.1'

Thanks for your time.
Pat

[pavelgl]

Try using ipset

config	ipset
	option	name		'proxy_exeptions'
	option	match		'src_net'
	option	storage		'hash'
	option	enabled		'1'
	list	entry		'192.168.2.135/32'
	list	entry		'192.168.2.136/32'
	list	entry		'192.168.2.137/32'


config redirect
	option src 'lan'
	option proto 'tcp'
	option src_dport '80'
	option ipset '!proxy_exeptions'
	option src_dip '!192.168.2.1'
	option dest_ip '192.168.2.1'
	option dest 'lan'
	option dest_port '8118'
	option name 'HTTP Transparent Proxy'
	option reflection '0' # Disable the reflection rule

Custom iptables rule also should be possible

iptables -t nat -I PREROUTING -m mac --mac-source aa:bb:cc:dd:ee:ff -p tcp --dport 80 -j ACCEPT

[trendy]

Ipset is a bit overkill for 2-3 hosts. You can add multiple source MACs in a rule.

[Ravenlost]

Thanks guys! I added 3 simple iptables rules (as you wrote pavelgl) and it seems to do the job ! Thanks