How to make Internet access only through a proxy?

Question

Squid

Hello.
Please tell me. Here I have a gateway on centos. Set up internet access. Put squid. In the Internet it is possible to leave a network both through a squid and without it. How to make, that it was possible to go, only through a squid? I tried to close port 80, in the INPUT table, but you can still access the Internet. Maybe I'm doing something wrong.
Here are the iptables rules.
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [357:335409]
:OUTPUT ACCEPT [16:3693]
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth1 -j ACCEPT
-A INPUT -j LOG
-A INPUT -j DROP
-A FORWARD -i eth1 -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -o eth1 -j ACCEPT
COMMIT
# Completed on Thu Jan 30 09:25:14 2014
# Generated by iptables-save v1.4.7 on Thu Jan 30 09:25:14 2014
*nat
:PREROUTING ACCEPT [28:1987 ]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [2:120]
-A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.0.1:3128
-A PREROUTING - i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Thu Jan 30 09:25:14 2014
# Generated by iptables-save v1 .4.7 on Thu Jan 30 09:25:14 2014
*mangle
:PREROUTING ACCEPT [761:387631]
:INPUT ACCEPT [93:11254]
:FORWARD ACCEPT [664:376133]
:OUTPUT ACCEPT [60:10798]
:POSTROUTING ACCEPT [724:386931]
COMMIT
I didn't write the rules myself, I found them in manuals. the interface that looks at the Internet eth0 - 192.168.1.2, looks at the network eth1 - 192.168.0.1. If you need anything else to provide, please let me know.
Thanks in advance

Answer 1

в Squid в конфигурации указать что этот порт 3128 "transparent"
Обычно делается дополнительный порт.
Еще придется закрывать 443 порт(https) - так как большинство сайтов по нему работают.

Answer 2

Пакеты предназначенные не серверу, не попадают в цепочку INPUT, они проходят через FORWARD.
А там у вас - все открыто.

Answer 3

Ищите про transparent squid.
Вам не запрещать трафик нужно, вам нужно его в squid перекидывать.