How can I redirect internet traffic from local to proxy server with ip tables (DEBIAN 6)

Question

So i made topology as shown in figure.

Router have 3 interfaces like this:

eth0 to internet side (with ip 192.168.1.10/24 gateway 192.168.1.254/24).

eth1 to server-PC side (with ip 192.168.20.1/28)

eth2 to Client side (with ip 172.16.20.1/29)

Server and client connected and get internet from router-pc. Server-pc uses a static ip (192.168.20.2), while the client gets an automatic ip from DHCP on router-pc

And i want to configure iptables on my Router-PC to redirect client's internet to Proxy server on my Server-PC. So client must using credential to access internet (i already configure authentication proxy on my squid and already configure proxy manually on client side).

The firewall i've running is:

iptables -t nat -A PREROUTING -p tcp -s 172.16.20.0/29 -j DNAT --to 192.168.20.2

192.168.20.2 is my Server's ip address. So, can you help me to fix the configuration I have done, in order to according to what I want?

Sorry for my bad english. Thanks.

Answer 1

First: please note that Debian 6 "squeeze" has been out of mainline support since 2013, and out of long term support since 2016. Using Debian 6 to prevent Internet access in this manner is very likely to be ineffective, due to security bugs that allow the restrictions to be bypassed, missing functionality that make you uncapable of implementing the requested rulesets, or both. I strongly recommend that you upgrade your system to a supported Debian release, preferably Debian 9 "stretch".

Second, combining authenticated proxies with transparent proxy mode doesn't work all that well. The problem is that the end host might also require authentication (e.g., because you're logging in to a DAV server which requires HTTP-level authentication), and then your transparent proxy is either going to eat those credentials, or be confused about them.

Instead, what I suggest is the following:

• Block all traffic that doesn't go over the proxy:

  iptables -A FORWARD -i eth2 -o eth0 -p tcp --dport 443 -j REJECT
  iptables -A FORWARD -i eth2 -o eth0 -p tcp --dport 80 -j REJECT
  

  This disallows all Internet traffic that doesn't go over the proxy.

• Configure your DHCP server so it sends a domain name to clients:

  subnet 172.16.20.1/29 {
      (...)
      option domain-name "example.com";
  };
  

  (use your local domain name, not example.com here)

• Configure your DNS server so it knows the hostname wpad.example.com, which should point to your router (again, substitute example.com for your domain name).

• Create a file wpad.dat, and give it the following contents:

  function FindProxyForURL(url, host) {
      return "PROXY 172.16.20.1:3128";
  }
  

  Note that this is simple Javascript; if you want to use a different proxy depending on the destination URL, just modify the function.

  Then serve that file over HTTP on the router, with the name "/wpad.dat". Make sure the MIME type for that file is either application/x-ns-proxy-autoconfig or application/x-javascript-config.

With that, browsers on your network will be automatically configured to use the proxy (provided you have the "Automatically detect settings" option switched on, where relevant), and will not confuse your users regarding authentication.