1

I am trying to build transparent proxy with squid on OpenBSD 5.7 with pf firewall.

I compile squid from sources with options:


$ squid -v
Squid Cache: Version **3.4.13**
configure options:  
--prefix=/usr/local/squid
--with-default-user=squid 
--enable-icmp
--enable-storeio=ufs,aufs
--enable-removal-policies=lru,heap
--disable-snmp
--disable-wccp 
--disable-wccpv2
--enable-pf-transparent
--enable-ipv6
--enable-referer-log
--with-nat-devpf
--enable-debug-cbdata
--enable-useragent-log
--enable-refererlog
--enable-cache-digests
--with-large-files
--with-pthreads
--without-mit-krb5
--without-heimdal-krb5
--without-gnugss
--disable-eui
--disable-auth
--enable-ltdl-convenience

$ uname -a
OpenBSD dns.localdomain 5.7 GENERIC#825 amd64

My squid.conf:


visible_hostname dns.local 
acl localnet src 192.168.1.0/24 # RFC1918 possible internal network

acl SSL_ports port 443
acl Safe_ports port 80      # http
acl Safe_ports port 21      # ftp
acl Safe_ports port 443     # https
acl CONNECT method CONNECT

http_access deny !Safe_ports

# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports

# Only allow cachemgr access from localhost
http_access allow localhost manager
http_access deny manager

#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#

# allow
http_access allow localnet
http_access allow localhost

# And finally deny all other access to this proxy
http_access deny all

# Squid normally listens to port 3128
http_port 3128
http_port 127.0.0.1:3129 intercept 

# disk cache directory.
cache_dir ufs /usr/local/squid/var/cache/squid 100 16 256

# Leave coredumps in the first cache dir
coredump_dir /usr/local/squid/var/cache/squid

#
# Add any of your own refresh_pattern entries above these.
#
refresh_pattern ^ftp:       1440    20% 10080
refresh_pattern ^gopher:    1440    0%  1440
refresh_pattern -i (/cgi-bin/|\?) 0 0%  0
refresh_pattern .       0   20% 4320

Enabled gateway to connect Internet:


net.inet.ip.forwarding=1
net.inet6.ip6.forwarding=1

pf.conf:


int_if = "vic1"
ext_if = "vic0"

lan_net = "192.168.1.0/24"

# Settings

set block-policy return
set loginterface egress
set skip on lo

# NAT 

match out on egress inet from !(egress:network) to any nat-to (egress:0)

pass in quick log on $ext_if inet proto tcp from 192.168.1.0/24 to port www divert-to 127.0.0.1 port 3129
pass out quick log inet from 192.168.1.0/24 divert-reply

# 
# Rules 
#
block all

# allow dns
pass quick on {$int_if, $ext_if} inet proto udp from {self, $lan_net} to any port 53

# allow local access to web
pass quick on $ext_if inet proto tcp from {self} to any port 80

# allow icmp
pass quick on $int_if inet proto icmp from $lan_net to any

# allow ssh from $ext_if
pass quick on $ext_if inet proto tcp from any to ($ext_if) port 22

I think problem in pf rule. Because pf can not divert packet to port 3129? I've tested with command: nc -l 3129 but it didn't response any HTTP header. The rule in Squid wiki can not apply to pf because syntax error.

Thank You in advance

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.