Transparent Proxy in squid not functional
I am using Fedora 9, I have compile the squid with source code, i also deleted the old RPM of squid. i then edited the squid.conf in /usr/local/squid/etc and set http_port 3128 transparent and allowed in my acl to my local network but the transparent proxy is not working. if i remove transparent proxy then squid works fine. when i try to make it transparent the squid access.log file does not show any request coming to it (no activity). i have also forwarded all the incoming traffic to squid port 3128. my port forwarding script is as under:
#squid server IP SQUID_SERVER="192.168.5.1" # Interface connected to Internet INTERNET="eth1" # Interface connected to LAN LAN_IN="eth0" # Squid port SQUID_PORT="3128" # DO NOT MODIFY BELOW # Clean old firewall iptables -F iptables -X iptables -t nat -F iptables -t nat -X iptables -t mangle -F iptables -t mangle -X # Load IPTABLES modules for NAT and IP conntrack support modprobe ip_conntrack modprobe ip_conntrack_ftp # For win xp ftp client #modprobe ip_nat_ftp echo 1 > /proc/sys/net/ipv4/ip_forward # Setting default filter policy iptables -P INPUT DROP iptables -P OUTPUT ACCEPT # Unlimited access to loop back iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT # Allow UDP, DNS and Passive FTP iptables -A INPUT -i $INTERNET -m state --state ESTABLISHED,RELATED -j ACCEPT # set this system as a router for Rest of LAN iptables --table nat --append POSTROUTING --out-interface $INTERNET -j MASQUERADE iptables --append FORWARD --in-interface $LAN_IN -j ACCEPT # unlimited access to LAN iptables -A INPUT -i $LAN_IN -j ACCEPT iptables -A OUTPUT -o $LAN_IN -j ACCEPT # DNAT port 80 request comming from LAN systems to squid 3128 ($SQUID_PORT) aka transparent proxy iptables -t nat -A PREROUTING -i $LAN_IN -p tcp --dport 80 -j DNAT --to $SQUID_SERVER:$SQUID_PORT # if it is same system iptables -t nat -A PREROUTING -i $INTERNET -p tcp --dport 80 -j REDIRECT --to-port $SQUID_PORT # DROP everything and Log it iptables -A INPUT -j LOG iptables -A INPUT -j DROP Can anybody tell me why my transparent proxy is not functional. Thanx |
I would look at putting all rules first then the default drop last. IP tables processes in sequential order so if it finds a drop first it drops that packet
|
Quote:
|
transparent proxy in squid not functional
hi there,
Am no expert at what you are asking but,,,transparent proxy using squid requires that you have tproxy support compiled in your kernel and i think that if ure using the stock fedora kernel it wont be there,,,so i think you need to apply tproxy patch to a supported kernel and recompile it with tproxy supprt enabled, then you'll need to patch iptables with a tproxy patch also,, i think there are only certain versions of iptables that are supported..am not up to date with the lattest stuff out there. That should get you started. am glad if i was of any help D.C |
All times are GMT -5. The time now is 01:58 AM. |