4

What I am trying to acheive

I have a CentOS (6.8) box 1.1.1.1 and a remote squid proxy server 2.2.2.2

I am trying to emulate the results of curl http://google.com -x 2.2.2.2:3128 with applications that don't have a HTTP proxy option, and don't respect the http_proxy variable (such as telegraf)

What I have tried so far

I've tried setting up iptables rules to forward traffic to the proxy:

iptables -t nat -A PREROUTING -i eth0 ! -s 2.2.2.2 -p tcp --dport 80 -j DNAT --to 2.2.2.2:3128
iptables -t nat -A POSTROUTING -o eth0 -s 1.1.1.1 -d 2.2.2.2 -j SNAT --to 1.1.1.1
iptables -A FORWARD -s 1.1.1.1 -d 2.2.2.2 -i eth0 -o eth0 -p tcp --dport 3128 -j ACCEPT

I then discovered that DNAT doesn't work properly if one is sending the traffic to a remote box, as return traffic doesn't route correctly. Based on this, I moved the application to a docker container (172.17.0.9) on the CentOS box, and planned to keep the iptables config on the host, amending the iptables config thusly:

iptables -t nat -A PREROUTING -i eth0 ! -s 2.2.2.2 -p tcp --dport 80 -j DNAT --to 2.2.2.2:3128
iptables -t nat -A POSTROUTING -o eth0 -s 172.17.0.0/16 -d 2.2.2.2 -j SNAT --to 1.1.1.1
iptables -A FORWARD -s 172.17.0.0/16 -d 2.2.2.2 -i eth0 -o eth0 -p tcp --dport 3128 -j ACCEPT

I also tried the following ruleset:

iptables -t nat -A PREROUTING -i eth0 -s 172.17.0.0/16 -p tcp --dport 80 -j DNAT --to-destination 2.2.2.2:3128
iptables -t nat -A POSTROUTING -o eth0 -d 2.2.2.2/32 -j MASQUERADE

The result of both of these rulesets was that http traffic was still attempting to go directly to the destination, rather than through the proxy.

[root@host ~]# tcpdump -nnn host 216.58.201.35
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
15:26:24.536668 IP 1.1.1.1.38566 > 216.58.201.35.80: Flags [S], seq 3885286223, win 14600, options [mss 1460,sackOK,TS val 2161333858 ecr 0,nop,wscale 9], length 0

The default gateway on the docker container is correctly set to the host, IP forwarding is enabled on the host.

[root@docker /]# ip route
default via 172.17.0.1 dev eth0

[root@host ~]# sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1

Am I missing something obvious here?

2 Answers 2

2

RESOLVED

Using iptables ruleset:

-A PREROUTING -p tcp -m tcp --dport 80 -j DNAT --to-destination 2.2.2.2:3128
-A POSTROUTING -s 172.17.0.0/16 -j SNAT --to-source 1.1.1.1

Looks like this was because of the interface being set incorrectly (should have been docker0) -- have removed the interface flag from the iptables rules and works fine now

0

DNAT will not work for current Squid versions.

It will produce the following error:

TCP_MISS/403 ... ORIGINAL_DST/<proxy-ip>
WARNING: Forwarding loop detected for...

NAT configuration will only work when used on the squid box. This is required to perform intercept accurately and securely. To intercept from a gateway machine and direct traffic at a separate squid box use policy routing

Source: https://wiki.squid-cache.org/ConfigExamples/Intercept/AtSource#outline

Possible solutions are:

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .