I am trying to configure the box I am using as a gateway/proxy/firewall to allow IP masquerading and finally switch over from using a proxy. It's a debian squeeze system.Currently, my hosts.allow file is empty (and hosts.deny says ALL: PARANOID), because squid allows requests on the required ports anyway (and also, I can ssh to the box just fine).Does iptables work the same way, i.e. can the hosts.allow file remain empty when iptables is set up properly?
hosts.allow: Not required when using iptables?
debian;iptables
The hosts.* files are not required when using iptables. Both have the ability to deny/allow access but work in very different ways.        Network          |       IPTables         /  \  TCPWrapper  Squid/Daemon  DaemonIptables is a kernel base packet filtering framework operating at a layer below tcpwrappers. If you DROP or REJECT something with iptables the packet will never reach userspace. It doesn't matter what the program is or how it is written, the packet will never exist from it's point of view. Programs that use TCPwrappers and it's hosts.* functionality run in user space and have to be built with libwrap to make use of the files, or emulate it by reading the hosts files and closing connections they receive from denied clients. Squid doesn't read the hosts.deny|allow files. It has it's own implementation for access control specified with acl's in squid.conf.  In the same way you can configure squids access control on top of iptables, you can use hosts.deny/allow on top of iptables. Those rules only come into play if iptables has let's the traffic through. Not that many programs support tcp_wrappers these days either, inetd, the super server, was the main one bit is slowly disappearing.