SETUP :
*Squid has been configured properly to act as transparent proxy.
*Squid & gateway-firewall, both are installed & working on a single box, so we donot need to do DNAT.
*Client is having SQUID/FIREWALL box to act as its gateway.
*As i have a static ip, i donot need to do MASQUAREDING as well.
*There's no rule running apart from the PREROUTING rule defined below & hence all the chains have their default policy as accept.
*Packet forwarding is enabled at kernel level.
*My LAN clients are not pointing towards any Name server.

As per the Official/Non-official howto's i only got to run
& it is running also.

Now my queries,
What happens to DNS, name queries.
Whenever my client try to browse, e.g. www.google.com, the first packet which comes to my box is for name conversion(dns) & not for port 80 & hence which doesnt hit the rule i am running & hence i am not able to make this transparent thing done. As its keep trying for name to ip conversion again & again for different DNS servers.

Though if i try to access any website with its ip address, i am not facing any problems, like in the same scenario i can browse google.com through http://64.233.187.99/

So what else am i supposed to do to make my transparent proxy works, though i expect that i should not be running any other iptable rule apart from the one specified above.

Kindly correct me whenever i am wrong, as its all logic & probably i am missing something.

With best regards,
Amit sharma

the dns has nothign at all to do with transparent proxying. you just need to provide global DNS to your clients, simple as that. if they can't resolve google.com how can they try to reach it? normally you'd just have a global dns server listed in /etc/resolv.conf or if you have an all in one adsl router on your net connection, they often serer global dns on behalf of the network, so use that a s a dns server and it relays to your isp.

Thanks for the clarification. But i am still little confused that why it isnt mentioned even in any of the transparent proxy's Official/Non-official how to's & tutorials. They should atleast mention that you also got to forward packets for DNS queries(in case of global dns) or you got to mention DNS atleast even in LAN based dns. Because in case of normal SQUID, we never used to use a DNS server on a client box as all the name conversions were going to be done through SQUID box itself.
--

Then in that case, if i do mention my global DNS to my clients then i got to do SNAT as well. As in the present state(without SNAT) this packet would'nt come back to me ever.
I can forward DNS queries with
& then after the name conversion, i can use my normal squid to work in transparent mode.

Is this the normal way a TRANSPARENT PROXY (squid) works ?
I mean DNS works seperately & if in case you are having a global ip DNS, you got to do SNAT & forward the packets apart from normal SQUID cache & provide function.

it's normal / expected that any given client pc can do global dns lookups. this isn't impressive or abnormal in any way and doesn't merit explicit requirements to be given. as i said above, the normal way on a home lan is that your adsl router either serves global dns directly or, as with *ANY* data going through the router, does a masquarade on that ip data.

again this is utterly unrelated to transparent proxies in every way. the fact that they are transparent should on it's own suggest that nothing else at all should be changed. any home user not using any proxy at all will do normal global dns lookups and then connect directly to that remote web server. exactly the same here, as if the client has no idea whatsoever that it's been proxied (i.e. it's transparent) it's not going to act differently in any way at all either.

Thanks. , I got the point.

Regards,
Amit..

and if you really don't wanna FORWARD any DNS packets, then just install a DNS daemon on your squid box and set the LAN clients to use that, instead of the external DNS... dnsmasq is what i use for this type of thing, for example... just my ...