LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 05-29-2008, 04:36 PM   #1
gr8scot
Member
 
Registered: Jun 2007
Distribution: Debian
Posts: 73

Rep: Reputation: 16
Question squid 2.6 -- working on port 3128, but not 'transparent'


I've followed the steps in this thread
http://www.linuxquestions.org/questi...id+transparent
and the links posted in it.

iptables:
$IPT -t nat -A PREROUTING -i $LANINTERFACE -p tcp \
--dport 80 -j REDIRECT --to-port 3128

squid.conf:
http_port 10.10.1.180:3128 transparent
always_direct allow all

What else do I need to do in 2.6 that isn't in this 3.0 how-to?
 
Old 05-29-2008, 05:26 PM   #2
win32sux
LQ Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 377Reputation: 377Reputation: 377Reputation: 377
Quote:
Originally Posted by gr8scot View Post
I've followed the steps in this thread
http://www.linuxquestions.org/questi...id+transparent
and the links posted in it.

iptables:
$IPT -t nat -A PREROUTING -i $LANINTERFACE -p tcp \
--dport 80 -j REDIRECT --to-port 3128

squid.conf:
http_port 10.10.1.180:3128 transparent
always_direct allow all

What else do I need to do in 2.6 that isn't in this 3.0 how-to?
I don't recall ever needing a always_direct line on Squid 2.x. You really should use a HOWTO which is specific to 2.6 if that's the version you are using.

That said, you haven't really explained what exactly is happening - saying it doesn't work doesn't say much, if anything. What is the Squid log showing? What about firewall logs? Are LAN clients able to ping the Squid box and hosts on the WAN? Are you getting any error messages in the browsers? Are the LAN clients able to use the proxy if manually configured to use it? Plus any other info you could provide would be great.

Last edited by win32sux; 05-29-2008 at 05:28 PM.
 
Old 05-29-2008, 07:28 PM   #3
gilead
Senior Member
 
Registered: Dec 2005
Location: Brisbane, Australia
Distribution: Slackware64 14.0
Posts: 4,125

Rep: Reputation: 165Reputation: 165
The docs I used to set this up were on the Squid site: http://wiki.squid-cache.org/SquidFaq/InterceptionProxy. Also as win32sux said, I've never had to use always_direct to get it working.
 
Old 06-01-2008, 04:51 PM   #4
gr8scot
Member
 
Registered: Jun 2007
Distribution: Debian
Posts: 73

Original Poster
Rep: Reputation: 16
Thumbs down /var/log/squid/cache.log

Quote:
Originally Posted by win32sux View Post
I don't recall ever needing a always_direct line on Squid 2.x.
I don't either, but for some reason, it was recommended in a HOW-TO. As I couldn't find any difference from my .conf file to requirements described in the 2.6 HOWTO, I started checking for problems encountered in all versions.

Quote:
Originally Posted by win32sux View Post
You really should use a HOWTO which is specific to 2.6 if that's the version you are using.
You assume I didn't, before scrounging around for long shots. Hmm.

Quote:
Originally Posted by win32sux View Post
What is the Squid log showing? What about firewall logs? Are LAN clients able to ping the Squid box and hosts on the WAN? Are you getting any error messages in the browsers? Are the LAN clients able to use the proxy if manually configured to use it? Plus any other info you could provide would be great.
LAN clients not only can ping the Squid box, they can browse the web when configured to use a proxy. I can change squid.conf to proxy on port 80, but even with the directive 'transparent,' truly transparent proxying does not occur. When a browser on the LAN is configured to use a direct connection to the Internet, the squid log records this:

2008/06/01 13:20:00| parseHttpRequest: NF getsockopt(SO_ORIGINAL_DST) failed: (92) Protocol not available
 
Old 06-01-2008, 06:38 PM   #5
win32sux
LQ Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 377Reputation: 377Reputation: 377Reputation: 377
Is Squid running on the same box as the iptables redirection rule?

Or are the proxy and the firewall two separate boxes?
 
Old 06-01-2008, 07:06 PM   #6
gr8scot
Member
 
Registered: Jun 2007
Distribution: Debian
Posts: 73

Original Poster
Rep: Reputation: 16
same box

Quote:
Originally Posted by win32sux View Post
Is Squid running on the same box as the iptables redirection rule?

Or are the proxy and the firewall two separate boxes?
Two NICs on that box, one connected to the internet [DSL router, to be exact] & the other connected to the LAN.
 
Old 06-01-2008, 08:53 PM   #7
gilead
Senior Member
 
Registered: Dec 2005
Location: Brisbane, Australia
Distribution: Slackware64 14.0
Posts: 4,125

Rep: Reputation: 165Reputation: 165
According to the info here, you need to make sure that you have run modprobe ip_conntrack before starting Squid. Do you have the module loaded (or support for conntrack compiled in)?
 
Old 06-02-2008, 12:00 AM   #8
win32sux
LQ Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 377Reputation: 377Reputation: 377Reputation: 377
Quote:
Originally Posted by gr8scot View Post
Two NICs on that box, one connected to the internet [DSL router, to be exact] & the other connected to the LAN.
Heh, yeah, it hit me later that what I was thinking when I asked didn't make sense, as REDIRECT only works on the local machine. Anyhow, it sounds like gilead might have found the culprit for your error message. Let us know.
 
Old 06-03-2008, 04:44 AM   #9
gr8scot
Member
 
Registered: Jun 2007
Distribution: Debian
Posts: 73

Original Poster
Rep: Reputation: 16
Angry giving up

Quote:
Originally Posted by gilead View Post
According to the info here, you need to make sure that you have run modprobe ip_conntrack before starting Squid. Do you have the module loaded (or support for conntrack compiled in)?
Thanks for the link, it matches my error message, but modprobe ip_conntrack has been in my firewall rules all along. Since the iptables script is in /etc/init.d, and the name begins with "00" I'm reasonably confident it's being run on startup, before squid. Since transparent proxying is not necessary, just something that seemed like it could be neat to know how to do, like a parlor trick, I'm giving up on it, at least for now. Thanks for trying.
 
  


Reply

Tags
iptables, squid


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Squid - Connection refused on port 3128 Deep13 Linux - Software 12 12-02-2009 04:49 AM
transparent squid proxy not working Niceman2005 Linux - Networking 5 01-17-2008 06:10 PM
Ubuntu, Squid Transparent Proxy server is not working pocs Linux - Networking 6 10-31-2007 11:42 AM
Squid, transparent proxy for more them one port maginotjr Linux - Networking 0 09-19-2007 08:52 AM
Failed to start squid because port 3128 is in use Frankd Linux - Software 0 10-14-2002 03:36 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 03:05 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration