I'm in the process of adding some parental control to my box (http filtering).

The box is used by the whole family (one account for each member) and squid runs on the very same machine.

I have two squid instances, one (for adults) only for caching, one (for children) using squidGuard.

To choose between both squid instances, I use --uid-owner with NAT rules.

iptables -t nat -A OUTPUT -m owner --uid-owner $owner -p tcp -m tcp --dport 80 -j REDIRECT --to-ports $port

(ditto for ip6tables)

Currently I use NAT for both IPv4 and IPv6 (with a fairly recent linux kernel), but Squid says that "intercept" only supports IPv4. I would like to have IPv6 too.

I tried to use TPROXY (e.g. using these rules) but I failed because I need --uid-owner which iptables wants to set on POSTROUTING (not on PREROUTING).

Those rules are:

iptables -t mangle -N DIVERT
iptables -t mangle -A DIVERT -j MARK --set-mark 1
iptables -t mangle -A DIVERT -j ACCEPT
iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129

How do I add appropriate --uid-owner rules in that mangle table? I mean, how do I decide to forward to port 3128 or 3129?

Edit: please don't answer saying that my NAT rule works well. I know that. I need to get rid of NAT because Squid's NAT is IPv4 only. So please, again, no NAT. Only TPROXY or mangle or whatever you call it that works with the mangle rules above.

  • Is your "box" a router or the system you are working on? You don't make that clear and the point is: --uid-owner makes sense on a user system only, PREROUTING on a router only. The page you refer to is about router configuration. May 21, 2013 at 21:23
  • ok sorry. Both. I'm at home, I don't have that many computers ;-) I'll clarify, thanks
    – cadrian
    May 22, 2013 at 8:42

1 Answer 1


You don't need --uid-owner in PREROUTING, you need it in OUTPUT (like in your example).

  • so I just need to replace -t nat by -t mangle and all is well?
    – cadrian
    May 21, 2013 at 4:41
  • @cadrian No, REDIRECT works in nat only but nat has an OUTPUT chain, too. Your example rule should be enough. PREROUTING is not used for locally generated packets and POSTROUTING can't do DNAT / REDIRECT. May 21, 2013 at 12:46
  • Sorry I don't understand. How do I use tproxy then?
    – cadrian
    May 21, 2013 at 17:57
  • @cadrian I don't understand the problem. I don't know tproxy but it probably is a proxy server listening in the localhost interface. Thus your rule should work. I assume it doesn't; otherwise you wouldn't have asked... Please provide the output of tcpdump -i lo -n. Are there INPUT rules blocking traffic to lo? May 21, 2013 at 18:05
  • I tried to clarify the question. Please read it again. Do you now understand my problem? Thanks.
    – cadrian
    May 21, 2013 at 19:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .