Transparent proxy on single machine

SadPenguin · 01-28-2007, 11:36 AM

I'm trying to set up a transparent proxy on a single desktop PC (which is connected to the internet via a cable modem connected to the ethernet port). This is to enable use of SquidGuard for web filtering purposes. My OS is Debian Etch.

I've got Squid working, and can connect through the proxy by configuring Firefox (etc.) to use the proxy server at port 8080. However, some programs (eg Google Earth) can't be configured manually to use the proxy server, and anyway I'd rather not have to do this for every program that uses web services.

I'm using the FireHOL firewall, and what I'm trying to do is to configure this to redirect all HTTP requests to the proxy server. However, it doesn't appear to be working - attempts to connect from browsers not using the proxy server fail.

First I tried using the following built-in FireHOL setting:

Code:

transparent_squid 8080 "proxy proxy"

When this didn't work, I tried using the following:

Code:

iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner --uid-owner proxy -j ACCEPT

iptables -t nat -A OUTPUT -p tcp --dport 8080 -m owner --uid-owner proxy -j ACCEPT

iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT --to-ports 8080

That is the current configuration, and as noted above it works fine for clients that are configured to use the proxy, but not for those that are still configured to connect directly.

In case it helps, here is my squid.conf (with comments stripped out):

Code:

http_port 8080 transparent
hierarchy_stoplist cgi-bin ?
acl QUERY urlpath_regex cgi-bin \?
cache deny QUERY
acl apache rep_header Server ^Apache
broken_vary_encoding allow apache
access_log /var/log/squid/access.log squid
hosts_file /etc/hosts
url_rewrite_program /usr/bin/squidGuard -c /etc/squid/squidGuard.conf
url_rewrite_children 5
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern .               0       20%     4320
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443          # https
acl SSL_ports port 563          # snews
acl SSL_ports port 873          # rsync
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl Safe_ports port 631         # cups
acl Safe_ports port 873         # rsync
acl Safe_ports port 901         # SWAT
acl purge method PURGE
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost
http_access deny all
http_reply_access allow all
icp_access allow all
cache_effective_user proxy
cache_effective_group proxy
coredump_dir /var/spool/squid

Any further tips greatly appreciated. I feel like I've spent the whole of the last 48 hours doing nothing else than trying to resolve this...

bitva · 01-29-2007, 04:49 PM

What if you have Squid listen on port 80 instead of 8080?

SadPenguin · 01-29-2007, 05:12 PM

Thanks - that solves the issue of apps needing to be configured to use the proxy.

However, there are a couple of unwelcome knock-on effects:

1. One knock-on effect is that blocked sites are now simply timing out (after a lo-o-o-o-ong wait) rather than giving the Squid error page previously shown.

2. SSL is getting blocked, so (e.g.) Gaim then doesn't work.

So I think I'm still looking for a solution that involves using the existing proxy port (8080).

SadPenguin · 01-30-2007, 03:11 AM

I think I've solved this. I looked at /var/log/squid/access.log, and noticed that packets redirected from the firewall were coming from my PC's IP address rather than from 127.0.0.1. However, Squid was configured to only accept packets from 127.0.0.1. By configuring Squid to also accept packets from my PC's IP address, everything is now working fine.

(If there is some reason why this is a horrendous security risk, please could someone let me know!)