LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices

Reply
 
Search this Thread
Old 05-26-2012, 03:08 PM   #16
Ser Olmy
Senior Member
 
Registered: Jan 2012
Distribution: Slackware
Posts: 1,915

Rep: Reputation: Disabled

Quote:
Originally Posted by robertjinx View Post
With this exact setup there is nothing happening. The requests don't go to the squid server, there is nothing in the squid logs.
When you say "nothing happens", do you mean the clients can't access web pages? Or do you mean that they can, but that they aren't being redirected through squid?

Edit: The following line contains a bug:
Code:
-A POSTROUTING -o eth1 -d 192.168.10.253/32 -p tcp --dport 80 -j MASQUERADE
It's NATing redirected traffic to the squid server, to make sure it gets routed through the gateway on its way back. However, the NATed packets go to port 3128 of the squid server, not port 80. The line should read:
Code:
-A POSTROUTING -o eth1 -d 192.168.10.253/32 -p tcp --dport 3128 -j MASQUERADE

Last edited by Ser Olmy; 05-26-2012 at 03:12 PM.
 
Old 05-27-2012, 12:03 PM   #17
robertjinx
Member
 
Registered: Oct 2007
Location: Prague, CZ
Distribution: RedHat / CentOS / Ubuntu / SUSE / Debian
Posts: 561

Original Poster
Rep: Reputation: 58
Ok, this rules sends requests to the squid server, but I get "Access Denied" from the squid server, which is again due to "WARNING: Forwarding loop detected for:"
 
Old 05-27-2012, 04:13 PM   #18
Ser Olmy
Senior Member
 
Registered: Jan 2012
Distribution: Slackware
Posts: 1,915

Rep: Reputation: Disabled
Quote:
Originally Posted by robertjinx View Post
Ok, this rules sends requests to the squid server, but I get "Access Denied" from the squid server, which is again due to "WARNING: Forwarding loop detected for:"
Then it seems traffic from the squid server to external web servers is still being redirected back to squid. The "ACCEPT" rule in the PREROUTING chain of the nat table is supposed to prevent that.

Simple test: Does telnet <IP address of a web server> 80 from the squid server land you at the server in question (as it should), or are you redirected back to the squid process at port 3128?

Last edited by Ser Olmy; 05-28-2012 at 02:41 PM.
 
Old 05-28-2012, 10:33 AM   #19
robertjinx
Member
 
Registered: Oct 2007
Location: Prague, CZ
Distribution: RedHat / CentOS / Ubuntu / SUSE / Debian
Posts: 561

Original Poster
Rep: Reputation: 58
The ip address of a webserver you referring to something like osnews.com and the answer is "Access Denied" also, but you have to keep in mind that on the squid server there are 2 network cards eth0: 192.168.10.254 and eth1: 192.168.10.253 (which is squid).

Squid is setup to run on 192.168.10.253:3128, but it doesn't matter, I'm still getting the same "Access Denied.".
 
Old 05-28-2012, 02:44 PM   #20
Ser Olmy
Senior Member
 
Registered: Jan 2012
Distribution: Slackware
Posts: 1,915

Rep: Reputation: Disabled
Quote:
Originally Posted by robertjinx View Post
but you have to keep in mind that on the squid server there are 2 network cards eth0: 192.168.10.254 and eth1: 192.168.10.253 (which is squid).
Any particular reason why you chose not to mention this earlier?

Add a the second ACCEPT rule to the nat chain for this IP address.

And how about the telnet test? Did it work or not?
 
Old 05-28-2012, 02:47 PM   #21
robertjinx
Member
 
Registered: Oct 2007
Location: Prague, CZ
Distribution: RedHat / CentOS / Ubuntu / SUSE / Debian
Posts: 561

Original Poster
Rep: Reputation: 58
Yes, I can telnet to 192.168.10.253 on port 3128. Actually I can use the proxy server the 'normal' way.
I'm still not sure what there is need for another ACCEPT rule if that ip address is not used at all and that squid listens only on 192.168.10.253?
 
Old 05-28-2012, 02:50 PM   #22
robertjinx
Member
 
Registered: Oct 2007
Location: Prague, CZ
Distribution: RedHat / CentOS / Ubuntu / SUSE / Debian
Posts: 561

Original Poster
Rep: Reputation: 58
OK here is the full and "proper" iptables:

Code:
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -o eth0 -j MASQUERADE
-A PREROUTING -i eth1 -d 192.168.10.253/32 -j ACCEPT
-A PREROUTING -i eth1 -d 192.168.10.254/32 -j ACCEPT
-A PREROUTING -i eth1 -s 192.168.10.0/24 -p tcp --dport 80 -j DNAT --to-destination 192.168.10.253:3128
-A POSTROUTING -o eth1 -d 192.168.10.253/32 -p tcp --dport 3128 -j MASQUERADE
COMMIT
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT
 
Old 05-28-2012, 03:09 PM   #23
Ser Olmy
Senior Member
 
Registered: Jan 2012
Distribution: Slackware
Posts: 1,915

Rep: Reputation: Disabled
Your iptables rules are still wrong. This:
Code:
-A PREROUTING -i eth1 -d 192.168.10.253/32 -j ACCEPT
-A PREROUTING -i eth1 -d 192.168.10.254/32 -j ACCEPT
...says "outbound traffic to 192.168.10.253 and 254 should not be DNATed". These rules should prevent traffic from these addresses from getting DNATed.

The correct version of the above:
Code:
-A PREROUTING -i eth1 -s 192.168.10.253/32 -j ACCEPT
-A PREROUTING -i eth1 -s 192.168.10.254/32 -j ACCEPT
Alter the rules and then please try the telnet test as outlined in post #18. Run the test from the squid server, with and without the squid proces running.

The purpose of the test is to determine whether outbound traffic from the squid server to port 80 on a server on the internet is getting redirected back to squid.
 
1 members found this post helpful.
Old 05-28-2012, 03:19 PM   #24
robertjinx
Member
 
Registered: Oct 2007
Location: Prague, CZ
Distribution: RedHat / CentOS / Ubuntu / SUSE / Debian
Posts: 561

Original Poster
Rep: Reputation: 58
Ok that works, seem to be fine now. Thanks very much, you've been a true help all the way
 
Old 06-04-2012, 05:58 AM   #25
kindman
LQ Newbie
 
Registered: Jun 2012
Location: USA
Posts: 1

Rep: Reputation: Disabled
Quote:
Originally Posted by Ser Olmy View Post
Of course. You need to exclude the Squid server from being redirected to itself. Flush and repopulate the PREROUTING chain as follows:
Code:
iptables -t nat -F PREROUTING
iptables -t nat -A PREROUTING -i eth1 -s 192.168.10.253/32 -j ACCEPT
iptables -t nat -A PREROUTING -i eth1 -s 192.168.10.0/24 \
-p tcp --dport 80 -j DNAT --to-destination 192.168.10.253:3128
...and you should have an ugly but proxy probably working hack.
I'm do it like you say and my problew was corrected ,I don't know what's your problem , why you cauldn't correct your problem like me ?

Last edited by kindman; 06-06-2012 at 03:35 AM.
 
Old 06-04-2012, 07:37 AM   #26
robertjinx
Member
 
Registered: Oct 2007
Location: Prague, CZ
Distribution: RedHat / CentOS / Ubuntu / SUSE / Debian
Posts: 561

Original Poster
Rep: Reputation: 58
What are you talking about, my issue was solved, even the thread is set as SOLVED.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Squid transparent proxy with iptables cksoo Linux - Server 5 06-12-2008 03:53 AM
IPTABLES for squid (Transparent proxy) kool_kid Linux - Networking 14 10-29-2007 10:45 AM
IPTABLES, SQUID, DANSGUARDIAN and Transparent Proxy metallica1973 Linux - Networking 18 09-03-2007 07:17 PM
Iptables mac-match VS. transparent proxy mchanea Linux - Security 4 12-22-2004 06:42 AM
Iptables+transparent Proxy seitan Linux - Networking 11 12-13-2004 08:42 PM


All times are GMT -5. The time now is 08:20 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration