2

So i made topology as shown in figure.

Topology

Router have 3 interfaces like this:

eth0 to internet side (with ip 192.168.1.10/24 gateway 192.168.1.254/24).

eth1 to server-PC side (with ip 192.168.20.1/28)

eth2 to Client side (with ip 172.16.20.1/29)

Server and client connected and get internet from router-pc. Server-pc uses a static ip (192.168.20.2), while the client gets an automatic ip from DHCP on router-pc

And i want to configure iptables on my Router-PC to redirect client's internet to Proxy server on my Server-PC. So client must using credential to access internet (i already configure authentication proxy on my squid and already configure proxy manually on client side).

The firewall i've running is:

iptables -t nat -A PREROUTING -p tcp -s 172.16.20.0/29 -j DNAT --to 192.168.20.2

192.168.20.2 is my Server's ip address. So, can you help me to fix the configuration I have done, in order to according to what I want?

Sorry for my bad english. Thanks.

11
  • Sorry for my bad english. I'm newbie on Networking. Please help me, i really apreciate your opinion/answer. Thanks. Apr 9, 2015 at 13:58
  • As the proxy has to be configured manually anyway on the clients, why not simply configure 192.168.20.2 as the proxy for the clients? Sometimes the simple solution is the best.
    – wurtel
    Apr 9, 2015 at 14:30
  • Thanks for the answer. I already configure 192.168.20.2 as my proxy server address. But some domains that should be blocked, it is not blocked and can still open by client. What should i do? Apr 10, 2015 at 7:35
  • Disable forwarding of outbound port 80 and 443 connections: iptables -A FORWARD -i eth2 -o eth0 -p tcp --dport 80 -j REJECT (repeat for port 443).
    – wurtel
    Apr 10, 2015 at 11:21
  • Thanks for the answer. Default policy is ACCEPT for all right? If all access through port 80 and 443 rejected, would not that mean local/client side can't access any web/url? Apr 10, 2015 at 13:08

1 Answer 1

1
+150

First: please note that Debian 6 "squeeze" has been out of mainline support since 2013, and out of long term support since 2016. Using Debian 6 to prevent Internet access in this manner is very likely to be ineffective, due to security bugs that allow the restrictions to be bypassed, missing functionality that make you uncapable of implementing the requested rulesets, or both. I strongly recommend that you upgrade your system to a supported Debian release, preferably Debian 9 "stretch".

Second, combining authenticated proxies with transparent proxy mode doesn't work all that well. The problem is that the end host might also require authentication (e.g., because you're logging in to a DAV server which requires HTTP-level authentication), and then your transparent proxy is either going to eat those credentials, or be confused about them.

Instead, what I suggest is the following:

  • Block all traffic that doesn't go over the proxy:

    iptables -A FORWARD -i eth2 -o eth0 -p tcp --dport 443 -j REJECT
    iptables -A FORWARD -i eth2 -o eth0 -p tcp --dport 80 -j REJECT
    

    This disallows all Internet traffic that doesn't go over the proxy.

  • Configure your DHCP server so it sends a domain name to clients:

    subnet 172.16.20.1/29 {
        (...)
        option domain-name "example.com";
    };
    

    (use your local domain name, not example.com here)

  • Configure your DNS server so it knows the hostname wpad.example.com, which should point to your router (again, substitute example.com for your domain name).
  • Create a file wpad.dat, and give it the following contents:

    function FindProxyForURL(url, host) {
        return "PROXY 172.16.20.1:3128";
    }
    

    Note that this is simple Javascript; if you want to use a different proxy depending on the destination URL, just modify the function.

    Then serve that file over HTTP on the router, with the name "/wpad.dat". Make sure the MIME type for that file is either application/x-ns-proxy-autoconfig or application/x-javascript-config.

With that, browsers on your network will be automatically configured to use the proxy (provided you have the "Automatically detect settings" option switched on, where relevant), and will not confuse your users regarding authentication.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .