First: please note that Debian 6 "squeeze" has been out of mainline support since 2013, and out of long term support since 2016. Using Debian 6 to prevent Internet access in this manner is very likely to be ineffective, due to security bugs that allow the restrictions to be bypassed, missing functionality that make you uncapable of implementing the requested rulesets, or both. I strongly recommend that you upgrade your system to a supported Debian release, preferably Debian 9 "stretch".
Second, combining authenticated proxies with transparent proxy mode doesn't work all that well. The problem is that the end host might also require authentication (e.g., because you're logging in to a DAV server which requires HTTP-level authentication), and then your transparent proxy is either going to eat those credentials, or be confused about them.
Instead, what I suggest is the following:
Block all traffic that doesn't go over the proxy:
iptables -A FORWARD -i eth2 -o eth0 -p tcp --dport 443 -j REJECT
iptables -A FORWARD -i eth2 -o eth0 -p tcp --dport 80 -j REJECT
This disallows all Internet traffic that doesn't go over the proxy.
Configure your DHCP server so it sends a domain name to clients:
subnet 172.16.20.1/29 {
(...)
option domain-name "example.com";
};
(use your local domain name, not example.com
here)
- Configure your DNS server so it knows the hostname
wpad.example.com
, which should point to your router (again, substitute example.com
for your domain name).
Create a file wpad.dat, and give it the following contents:
function FindProxyForURL(url, host) {
return "PROXY 172.16.20.1:3128";
}
Note that this is simple Javascript; if you want to use a different proxy depending on the destination URL, just modify the function.
Then serve that file over HTTP on the router, with the name "/wpad.dat". Make sure the MIME type for that file is either application/x-ns-proxy-autoconfig
or application/x-javascript-config
.
With that, browsers on your network will be automatically configured to use the proxy (provided you have the "Automatically detect settings" option switched on, where relevant), and will not confuse your users regarding authentication.
iptables -A FORWARD -i eth2 -o eth0 -p tcp --dport 80 -j REJECT
(repeat for port 443).