Ubuntu Server 16.04 Squid Proxy authentication with 2 NIC setup

tangozopo · 04-17-2018, 10:25 AM

I have an ubuntu proxy running server 16.04, squid 3.5.12 and NCSA. The server has two NICs, one connected to internet router, eno1 with IP 192.168.1.2/24 and another connected to client LAN, eno2 with IP 192.168.2.1/24. When I configure proxy settings on client machine, the browser requests login credentials but when I choose auto detect proxy settings, the user browses internet with nothing even being captured in access.log. Primarily, I want users who bypass proxy settings not to be able to browse internet, that's number one objective. Here is my priority list:

All client users must be authenticated when browsing internet – username and password (a must)
Users who bypass proxy settings on their browser must not browse internet (a must)
Authenticated users must not access blocked sites
Allow single login per user

1 and 2 are a must though 3 and 4 are also important
I can say l have managed to get objective 1 with the following configuration

Here is interface configuration

Code:

source /etc/network/interfaces.d/*
auto lo
iface lo inet loopback

auto eno1
iface eno1 inet static
        address 192.168.1.2
        netmask 255.255.255.0
        network 192.168.1.0
        broadcast 192.168.1.255
        gateway 192.168.1.1
        # dns-* options are implemented by the resolvconf package, if installed
        dns-nameservers 192.168.0.5
        dns-search hit.ac.zw

#Secondary interface
auto eno2
iface eno2 inet static
        address 192.168.2.1
        netmask 255.255.255.0
        network 192.168.2.0
pre-up iptables-restore < /etc/iptables/rules.v4

Here is Squid configuration

Code:

acl ncsa_users proxy_auth REQUIRED
cl allowed_anytime proxy_auth "/etc/squid/allowed_anytime"
acl blocked_sites url_regex -i "/etc/squid/blocked_sites"
acl loopback src 127.0.0.1/32
acl localnet src 192.168.2.0/24


acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT

http_access deny !ncsa_users
http_access allow allowed_anytime
http_access allow ncsa_users
http_access allow localnet
http_access allow loopback
http_access deny blocked_sites
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access deny manager
http_access deny all

http_port 3128

refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern (Release|Packages(.gz)*)$      0       20%     2880
refresh_pattern .               0       20%     4320

Here is iptable rules

Code:

# Generated by iptables-save v1.6.0 on Mon Apr 16 16:17:18 2018
*nat
:PREROUTING ACCEPT [2761:177094]
:INPUT ACCEPT [501:40165]
:OUTPUT ACCEPT [50:3589]
:POSTROUTING ACCEPT [2310:140518]
-A PREROUTING -i eno2 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.2.1:3128
-A PREROUTING -i eno2 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
-A POSTROUTING -s 192.168.2.0/24 -o eno1 -j MASQUERADE
COMMIT
# Completed on Mon Apr 16 16:17:18 2018
# Generated by iptables-save v1.6.0 on Mon Apr 16 16:17:18 2018
*filter
:INPUT ACCEPT [4063:444056]
:FORWARD ACCEPT [18771:5598355]
:OUTPUT ACCEPT [6282:700636]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A FORWARD -i eno2 -o eno1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eno2 -p tcp -m tcp --dport 3128 -j ACCEPT
#-A FORWARD -i eno1 -j DROP
#-A FORWARD -j DROP
COMMIT
# Completed on Mon Apr 16 16:17:18 2018

Interface eno1, 192.168.1.2 is the one connected to the internet router
Interface eno2. 192.168.2.1 is the LAN interface which connects clients