1

I have two interfaces in my proxy server eth0 and eth1. where eth0 connects to local (private) network wile eth1 connects to internet.My squid version is 3.3.8 and centos 7 is my OS. I have to configure transparent proxy. I know that for it there should be a single change like

http_port 8080 intercept

I have done this but still I could not access internet and there is no infomation in squid access.log file. But When I enable proxy on client, there squid log start to populate.

I think I am missing some iptable rules. What should be those rules so that my client can access internet via proxy (transparent mode).

I have applied two rules

iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080

After apply given two rules, I got following in tcpdum

15:56:53.858317 ARP, Request who-has localhost.localdomain tell 192.168.57.100, length 46
15:56:53.858330 ARP, Reply localhost.localdomain is-at 0a:00:27:00:00:01 (oui Unknown), length 28
15:56:53.859825 IP 192.168.57.100.55833 > localhost.localdomain.domain: 17156+ A? www.google.com. (32)
15:56:53.859866 IP localhost.localdomain > 192.168.57.100: ICMP localhost.localdomain udp port domain unreachable, length 68
15:56:53.860006 IP 192.168.57.100.55833 > localhost.localdomain.domain: 56135+ AAAA? www.google.com. (32)
2
  • Who is the router of your network? the squid box? A modem? A Linux server? A Cisco? A firewall? What brand?
    – Rui F Ribeiro
    Apr 26, 2016 at 12:46
  • Our proxy server is under the umbrella of another proxy/router server.
    – Hafiz Muhammad Shafiq
    Apr 27, 2016 at 6:14

1 Answer 1

Reset to default
0

try this iptables rules:

iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080

masquerade = allow private ip to access internet

--dport 80 -j redirect --to-port 8080 = any request from private ip that access web will be redirected to our proxy server at port 8080.

4
  • If the squid box is the Internet router, the PREROUTING will feed the requests to squid. The OP is not explicit about that. The MASQUERADE is for routing the other traffic; for that it is also necessary to allow ip forwarding.
    – Rui F Ribeiro
    Apr 26, 2016 at 13:14
  • well just make sure the client pc's gateway destinated to ip address of the proxy server (as long as he already set the proxy server's default route to the gateway of internet and can access the internet). i think it will work also even without ip public. Because that iptables rules masquerade ( change src nat ).
    – Toro tero
    Apr 26, 2016 at 13:15
  • Internet does not route private IP addresses.
    – Rui F Ribeiro
    Apr 26, 2016 at 13:16
  • I have updated my question after applying two iptable rule
    – Hafiz Muhammad Shafiq
    Apr 27, 2016 at 10:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .