ClearFoundation

You have a typo in your rules which is why I always recommend trying them at the command line so you can see the error messages. Can you change -dport to --dport?

Hello,

Friends, I'm really desperate, my clearos 5.2 is blocking a site that uses HTTPS protocol and a non-standar port.

I've add the port 8443 on the incoming and outgoing rules of the firewall, I've add de IP of the site in the Proxy and content-filter exceptions, I've add those rules on /etc/rc.d/rc.firewall.local

iptables -A INPUT --src XXX.XXX.XXX.XXX -p tcp --sport 8443 -j ACCEPT
iptables -A INPUT --src XXX.XXX.XXX.XXX -p udp --sport 8443 -j ACCEPT

But I can't access to the site _XXX.XXX.XXX.XXX:8443/charge, I was reviewing the acces.log file of de squid, and I see that the error is:

1336494524.922 0 192.168.xxx.xxx TCP_DENIED/403 857 CONNECT xxx.xxx.xxx.xxx:8443 - NONE/- text/html

Anyone can give an idea to solve this problem?

Thanks for all

Did you update the ACLs in squid to allow port 8443?

See below for the section in squid that needs to be updated... you will need similar entries as that for port 443... note mine below is changed from a 'vanilla' CC config file...

Tony!

You was my salvation!,

your answer was the solutions, I did add the port at the SSL_ports list and this opened the site.

Thanks again

@Tony,
Clearly your solution has worked, but if the site is whitelisted, and squid bypassed for that IP/port in iptables, do you know why you needed your solution as well? Do you think there was more port 8443 traffic to different IP's or something else?

Sorry Nick - I wasn't following closely this, or any indeed any other thread for that mater in ClearOS recently... far too busy at work with database and system migrations...

Clearly Squid was not being bypassed, as squid was objecting to the traffic it was being asked to handle for which it didn't have an ACL. I don't have time to analyse the iptables rules, indeed I consider it is impossible without seeing all the iptables entries listed - order for instance is important - and I didn't notice a complete list anyway when I rather quickly scanned the thread...

So the quick and simple solution since squid was the blocking agent from the log extract provided - was to change squid to allow the traffic...

Feel free to work with the OP as to why iptables wasn't doing the job... I didn't even look as his connection configuration - or indeed know whether it was clearly explained... I didn't read that far... just saw a plea for help and recognised an option for a quick fix in his append just before mine - I know I'm not veing very helpful - sorry