Wireless + Fedora + IPTables + Squid + DansGuardian

I have an existing Fedora installation that serves as our mail/www
server along with our content filter running Squid and DansGuardian.
Everything is working great. I would like to add wireless capability
to our area by purchasing a WAP or Wireless Router and connecting this
to our network, but my question is: how would I force the wireless
users to go through squid/dansguardian for their internet/HTTP access?
I currently have a PIX which does DHCP, but my idea was to get a
wireless router and plug it into a 2nd NIC on the linux server. Then
use IPTables to route that traffic to the dansguardian port on that
machine if it is HTTP/HTTPS or drop it otherwise. This way the
wireless router could serve as the DHCP server for the wireless users
and they could be pushed through our proxy without changes in their
clients.

The only question I have is if this is possible/easy to setup with
IPTables (which is currently not installed/setup on the server as we
use the PIX for our firewall and can trust our existing inside
machines), and if it is possible would it be better for me to purchase
the WAP or the wireless router? I am leaning towards the wireless
router due to its ability to server as a DHCP server and therefore
also force the DNS settings on the machines, this would keep me from
having to setup DHCP on the existing server.

Any help would be appreciated,

Thanks,

Michael

"Michael Cox" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed) om...
> but my question is: how would I force the wireless
> users to go through squid/dansguardian for their internet/HTTP access?

On your linux box set up an iptables rule:

iptables -t nat -A PREROUTING -i eth1 -p tcp -s 10.0.0.0/27 --dport 80 -j
REDIRECT --to-port 8080

Where 'eth1' is the interface that has the wireless clients
'10.0.0.0/27' is the network range you want to force to proxy
'8080' is whatever port squid is running on

This works for sure (I am doing it) if the linux box is also doing NAT for
the clients, but it may not if it is not. I use shorewall now to do all the
nat and redirect stuff, in shorewall the rule is:

(in rules file)
REDIRECT loc 8080 tcp www - !10.0.0.1

(this forces everyone on NAT (the loc network) except 10.0.0.1 to use the
proxy when accessing port 80 outbound)

There may be a setting you have to make in squid to tell it it is acting as
a transparent proxy...