I have to setup a transparent squid proxy server using iptables and squid. Following is the scenario:

[INTERNAL NETWORK] -> [Main Switch] -> [Proxy Server] -> [Firewall] -> [EXTERNAL NETWORK]

I am having a system with SLES 11 SP3 installed on it and I am supposed to configure it as a router/gateway first, before making any squid configurations.

What should be the iptables rules to meet the requirements?

  • I think you need to this concept : tldp.org/HOWTO/TransparentProxy-6.html , The given link doesn't explain squid configuration , when you need to transparency proxy , you need to configure squid along with iptables or PF, ipfw , or any firewall. – PersianGulf Jan 21 '15 at 6:18
  • By the way, I don't recall to say SELS itself has a firewall buitl-in beside iptables. YAST configure it. be carefule. – PersianGulf Jan 21 '15 at 6:19
  • @MohsenPahlevanzadeh - You're right. It does have a built-in firewall. I was not able to connect it through ssh, until I disabled it. – Mandar Shinde Jan 21 '15 at 6:42

To redirect traffic that doesn't know about the proxy (i.e. it's not configured in the browser) so that it is sent to squid, you need to add a PREROUTING rule with iptables:

iptables -t nat -A PREROUTING -i internal_interface -p tcp --dport 80 -j REDIRECT --to-ports 3128

Replace internal_interface with whatever interface the client traffic will come from, e.g. eth0.

This will redirect traffic from your internal network bound for port 80 to port 3128 on the local system (that is the default port for squid, adjust accordingly).

As you only asked for the iptables config I'll not go into the necessary squid config.

  • To proxy traffic from localhost on the server you need additionally something like iptables -t nat -A OUTPUT -p tcp -o external_interface --dport 80 -m owner ! --uid-owner proxy -j REDIRECT --to-ports 3128 where proxy is the username of squid. – jofel Jan 21 '15 at 11:19
  • The answer is for the case, the server is already working as a (normal) gateway with echo "1" > /proc/sys/net/ipv4/ip_forward and corresponding iptables rules. – jofel Jan 21 '15 at 11:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.