Squid, TPROXY and SquidGuard

toure32 · 08-06-2010, 04:43 AM

Hi,
all i've implemented squid with Tproxy and SquidGuard for transparent content filtering.
squid conf:

Code:

http_port 3129 tproxy
redirect_program /usr/local/bin/squidGuard -c  /usr/local/squidGuard/squidGuard.conf -d
redirect_children 10

my squidGuard.conf

Code:

.....
dest  porn {
 	domainlist  	     porn/domains 
 	urllist     	     porn/urls 
 	expressionlist       porn/expressions 
 	redirect	     http://localhost/denied.bl
}

acl {
 	winxp_1 {
 		pass !porn any         
 	}
 	default {
 		pass any
 	}
 }
......

HTTP traffic are redirect via:

Code:

iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129

My traffic passthrougth squid but the contents are not filtered because the user can access porn site.
can someone help me?
regards

rameshshihora · 08-08-2010, 06:48 PM

Run the below command let me know the output of cache.log file.

"/usr/sbin/squidGuard -c /etc/squid/squidGuard.conf -C all"
/usr/bin/killall -HUP squid

Thanks & Regards,
Ramesh Shihora

toure32 · 08-09-2010, 07:12 AM

hi, after

Code:

/usr/local/bin/squidGuard -c /usr/local/squidGuard/squidGuard.conf -C all
killall -HUP squid

this is the ouput in my cache.log

Code:

2010/08/09 12:05:05| Reconfiguring Squid Cache (version 3.1.6)...
2010/08/09 12:05:05| FD 36 Closing HTTP connection
2010/08/09 12:05:05| FD 37 Closing HTTP connection
2010/08/09 12:05:05| Processing Configuration File: /usr/local/squid/etc/squid.conf (depth 0)
2010-08-09 12:05:05 [2257] squidGuard stopped (1281355505.379)
2010-08-09 12:05:05 [2258] squidGuard stopped (1281355505.380)
2010-08-09 12:05:05 [2259] squidGuard stopped (1281355505.381)
2010-08-09 12:05:05 [2260] squidGuard stopped (1281355505.382)
2010-08-09 12:05:05 [2261] squidGuard stopped (1281355505.383)
2010-08-09 12:05:05 [2262] squidGuard stopped (1281355505.384)
2010-08-09 12:05:05 [2263] squidGuard stopped (1281355505.385)
2010-08-09 12:05:05 [2264] squidGuard stopped (1281355505.386)
2010-08-09 12:05:05 [2265] squidGuard stopped (1281355505.388)
2010/08/09 12:05:05| Starting Authentication on port [::]:3128
2010/08/09 12:05:05| Disabling Authentication on port [::]:3128 (interception enabled)
2010/08/09 12:05:05| Disabling IPv6 on port [::]:3128 (interception enabled)
2010/08/09 12:05:05| Starting IP Spoofing on port [::]:3129
2010/08/09 12:05:05| Disabling Authentication on port [::]:3129 (IP spoofing enabled)
2010-08-09 12:05:05 [2266] squidGuard stopped (1281355505.389)
2010/08/09 12:05:05| WARNING cache_mem is larger than total disk cache space!
2010/08/09 12:05:05| Squid modules loaded: 0
2010/08/09 12:05:05| Store logging disabled
2010/08/09 12:05:05| DNS Socket created at [::], FD 8
2010/08/09 12:05:05| DNS Socket created at 0.0.0.0, FD 9
2010/08/09 12:05:05| Adding nameserver 192.168.2.1 from /etc/resolv.conf
2010/08/09 12:05:05| Adding nameserver 196.201.78.13 from /etc/resolv.conf
2010/08/09 12:05:05| helperOpenServers: Starting 10/10 'squidGuard' processes
2010-08-09 12:05:05 [2280] New setting: dbhome: /usr/local/squidGuard/db
2010-08-09 12:05:05 [2280] New setting: logdir: /usr/local/squidGuard/log
2010-08-09 12:05:05 [2280] init domainlist /usr/local/squidGuard/db/porn/domains
2010-08-09 12:05:05 [2280] loading dbfile /usr/local/squidGuard/db/porn/domains.db
2010-08-09 12:05:05 [2280] init urllist /usr/local/squidGuard/db/porn/urls
2010-08-09 12:05:05 [2280] loading dbfile /usr/local/squidGuard/db/porn/urls.db
2010-08-09 12:05:05 [2280] init expressionlist /usr/local/squidGuard/db/porn/expressions
2010-08-09 12:05:05 [2280] init domainlist /usr/local/squidGuard/db/adult/domains
2010-08-09 12:05:05 [2280] loading dbfile /usr/local/squidGuard/db/adult/domains.db
2010-08-09 12:05:05 [2280] init urllist /usr/local/squidGuard/db/adult/urls
2010-08-09 12:05:05 [2280] loading dbfile /usr/local/squidGuard/db/adult/urls.db
2010-08-09 12:05:05 [2280] init expressionlist /usr/local/squidGuard/db/adult/expressions
2010-08-09 12:05:05 [2280] init domainlist /usr/local/squidGuard/db/chat/domains
2010-08-09 12:05:05 [2280] loading dbfile /usr/local/squidGuard/db/chat/domains.db
2010-08-09 12:05:05 [2281] New setting: dbhome: /usr/local/squidGuard/db
2010-08-09 12:05:05 [2281] New setting: logdir: /usr/local/squidGuard/log
2010-08-09 12:05:05 [2280] init urllist /usr/local/squidGuard/db/chat/urls
2010-08-09 12:05:05 [2280] loading dbfile /usr/local/squidGuard/db/chat/urls.db
2010-08-09 12:05:05 [2280] init domainlist /usr/local/squidGuard/db/drogue/domains
2010-08-09 12:05:05 [2280] loading dbfile /usr/local/squidGuard/db/drogue/domains.db
2010-08-09 12:05:05 [2280] init urllist /usr/local/squidGuard/db/drogue/urls
2010-08-09 12:05:05 [2280] loading dbfile /usr/local/squidGuard/db/drogue/urls.db
2010-08-09 12:05:05 [2280] init domainlist /usr/local/squidGuard/db/games/domains
2010-08-09 12:05:05 [2280] loading dbfile /usr/local/squidGuard/db/games/domains.db
2010-08-09 12:05:05 [2281] init domainlist /usr/local/squidGuard/db/porn/domains
2010-08-09 12:05:05 [2281] loading dbfile /usr/local/squidGuard/db/porn/domains.db
2010-08-09 12:05:05 [2281] init urllist /usr/local/squidGuard/db/porn/urls
2010-08-09 12:05:05 [2281] loading dbfile /usr/local/squidGuard/db/porn/urls.db
2010-08-09 12:05:05 [2281] init expressionlist /usr/local/squidGuard/db/porn/expressions
2010-08-09 12:05:05 [2281] init domainlist /usr/local/squidGuard/db/adult/domains
2010-08-09 12:05:05 [2281] loading dbfile /usr/local/squidGuard/db/adult/domains.db
2010-08-09 12:05:05 [2281] init urllist /usr/local/squidGuard/db/adult/urls
2010-08-09 12:05:05 [2281] loading dbfile /usr/local/squidGuard/db/adult/urls.db
2010-08-09 12:05:05 [2281] init expressionlist /usr/local/squidGuard/db/adult/expressions
2010-08-09 12:05:05 [2281] init domainlist /usr/local/squidGuard/db/chat/domains
2010-08-09 12:05:05 [2281] loading dbfile /usr/local/squidGuard/db/chat/domains.db
2010-08-09 12:05:05 [2281] init urllist /usr/local/squidGuard/db/chat/urls
2010-08-09 12:05:05 [2281] loading dbfile /usr/local/squidGuard/db/chat/urls.db
2010-08-09 12:05:05 [2281] init domainlist /usr/local/squidGuard/db/drogue/domains
2010-08-09 12:05:05 [2281] loading dbfile /usr/local/squidGuard/db/drogue/domains.db
2010-08-09 12:05:05 [2281] init urllist /usr/local/squidGuard/db/drogue/urls
2010-08-09 12:05:05 [2281] loading dbfile /usr/local/squidGuard/db/drogue/urls.db
2010-08-09 12:05:05 [2281] init domainlist /usr/local/squidGuard/db/games/domains
2010-08-09 12:05:05 [2281] loading dbfile /usr/local/squidGuard/db/games/domains.db
2010-08-09 12:05:05 [2281] init urllist /usr/local/squidGuard/db/games/urls
2010-08-09 12:05:05 [2281] loading dbfile /usr/local/squidGuard/db/games/urls.db
2010-08-09 12:05:05 [2281] init domainlist /usr/local/squidGuard/db/malware/domains
2010-08-09 12:05:05 [2281] loading dbfile /usr/local/squidGuard/db/malware/domains.db
2010-08-09 12:05:05 [2280] init urllist /usr/local/squidGuard/db/games/urls
2010-08-09 12:05:05 [2280] loading dbfile /usr/local/squidGuard/db/games/urls.db
2010-08-09 12:05:05 [2280] init domainlist /usr/local/squidGuard/db/malware/domains
2010-08-09 12:05:05 [2280] loading dbfile /usr/local/squidGuard/db/malware/domains.db
2010-08-09 12:05:05 [2280] init urllist /usr/local/squidGuard/db/malware/urls
2010-08-09 12:05:05 [2280] loading dbfile /usr/local/squidGuard/db/malware/urls.db
2010-08-09 12:05:05 [2280] init expressionlist /usr/local/squidGuard/db/malware/expressions
2010-08-09 12:05:05 [2280] init domainlist /usr/local/squidGuard/db/violence/domains
2010-08-09 12:05:05 [2280] loading dbfile /usr/local/squidGuard/db/violence/domains.db
2010-08-09 12:05:05 [2280] init urllist /usr/local/squidGuard/db/violence/urls
2010-08-09 12:05:05 [2280] loading dbfile /usr/local/squidGuard/db/violence/urls.db
2010-08-09 12:05:05 [2280] init expressionlist /usr/local/squidGuard/db/violence/expressions
2010-08-09 12:05:05 [2280] init domainlist /usr/local/squidGuard/db/warez/domains
2010-08-09 12:05:05 [2280] loading dbfile /usr/local/squidGuard/db/warez/domains.db
2010-08-09 12:05:05 [2280] init urllist /usr/local/squidGuard/db/warez/urls
2010-08-09 12:05:05 [2280] loading dbfile /usr/local/squidGuard/db/warez/urls.db
2010-08-09 12:05:05 [2280] init expressionlist /usr/local/squidGuard/db/warez/expressions
2010-08-09 12:05:05 [2280] squidGuard 1.4 started (1281355505.469)
2010-08-09 12:05:05 [2280] squidGuard ready for requests (1281355505.526)

2010/08/09 12:05:05| Loaded Icons.
2010/08/09 12:05:05| Ready to serve requests.

toure32 · 08-09-2010, 09:47 AM

hi,
i'd like to notice that when i'm not in tproxy mode content are filtered.

Quote:

iptables -t nat -A PREROUTING -p TCP --dport 80 -j REDIRECT --to-port 3128

and i don't know why it not working when in TPROXY mode.
regards.