0

Can we redirect DNS (tcp/udp) requests to Squid proxy in non-transparent mode (3128) using iptables? (Would the squid proxy understand this and process it?)

example rule to redirect tcp 53 (It could be another similar):

iptables -t nat -A PREROUTING -s 192.168.0.0/24 -i eth1 -p tcp --dport 53 -j REDIRECT --to-port 3128

example rule to redirect udp 53 (It could be another similar):

Note: Squid "listen" high udp port. example: 36352, Command: netstat -tlunp | grep squid

reference: http://linuxplayer.org/2012/02/why-squid-listen-on-high-udp-port-number

iptables -t nat -A PREROUTING -s 192.168.0.0/24 -i eth1 -p udp --dport 53 -j REDIRECT --to-port 36352

PD: These are just examples of squid directives related to DNS. I am not claiming that they serve my purposes:

positive_dns_ttl 
negative_dns_ttl 
dns_nameservers 8.8.8.8 8.8.4.4
udp_incoming_address

If this can not be done, I accept alternatives

2

Squid is not a DNS proxy and does not accept DNS requests.

Looking at the documentation for the directives you highlight it's quite clear these are for internal settings and have nothing to do with external client access:

In explicit response to your last sentence/question, there are no alternative ways to direct DNS traffic to a Squid proxy, because Squid does not proxy DNS traffic.

Further reading


I've been thinking some more about this, and trying to second-guess the problem you actually want to solve. You do realise that although Squid doesn't proxy DNS requests, all standard DNS servers do this? Examples I can cite include Dnsmasq and Bind.

  • in this site, say the opposite linuxplayer.org/2012/02/… – ajcg Jun 4 at 2:03
  • 1
    @ajcg no it doesn't. That article says the same as I do: that the DNS service is to manage Squid's internal queries. – roaima Jun 4 at 6:00
  • 1
    There are already plenty of questions and answers relating to dnsmasq. I've answered your question here. – roaima Jun 4 at 13:23
  • 1
    Set up a DNS server and use iptables to redirect all DNS requests (UDP and TCP) to the server. Better still, provide the correct information as part of the DHCP response to your phone devices. – roaima Jun 4 at 14:05
  • 1
    DHCP option 252 is WPAD, and has nothing to do with DNS. – roaima Jun 4 at 14:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.