Squid / IPtables confusion

autone · 2011-04-13 04:11:29

Hi all,

I've got SQUID running as a transparent proxy for my home network. The main network interface is eth0. I've got a PPTP VPN connection on ppp0.

SQUID runs fine and all data goes through eth0. I am trying to redirect SQUID or all outgoing requests to use ppp0.

I figured the following IPTABLES rules are too basic;

iptables -t nat -o ppp0 -A POSTROUTING -j MASQUERADE
iptables -A INPUT -i ppp0 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -i eth0 -0ppp0 -p tcp --dport 80 -j ACCEPT

Anyone able to give any pointers?

Much thanks.

fukawi2 · 2011-04-13 08:22:26

autone wrote:

The main network interface is eth0.

Does "main" mean internet connection, or your local network?

autone wrote:

I am trying to redirect SQUID or all outgoing requests to use ppp0.

Can you clarify what you mean by this? You want all Proxy / Port 80 traffic to route via ppp0? Or all HTTP traffic coming in ppp0 to be transparently redirected to the proxy?

autone wrote:

iptables -t nat -o ppp0 -A POSTROUTING -j MASQUERADE

This just SNAT's any traffic going our ppp0 to the address of ppp0

autone wrote:

iptables -A INPUT -i ppp0 -p tcp --dport 80 -j ACCEPT

This allows access to the local machine on port 80. No point doing that unless you're running a web server.

autone wrote:

iptables -A FORWARD -i eth0 -0ppp0 -p tcp --dport 80 -j ACCEPT

-0 isn't a valid iptables rule, but I assume you meant -o. This allows all traffic from 'eth0' to 'ppp0' on port 80, without using the proxy.

autone · 2011-04-13 08:42:49

Hi,

Thanks for the reply.

"main" means the local network with an internet connection.

"You want all Proxy / Port 80 traffic to route via ppp0?"

Yes. Basically, a local network computer will be directed to the SQUID server and the SQUID server will then perform the fetch request for the computer. Connections from the local network to the squid server is via eth0.

Connections from the squid server to the internet should be via ppp0. It's the last part that I am stuck at.

Hope this helps clear up any confusion.

Any and all help is appreciated.

fukawi2 · 2011-04-13 09:15:03

autone wrote:

Connections from the squid server to the internet should be via ppp0. It's the last part that I am stuck at.

Right, gotcha

You have to create a second routing table and then mark these connections to use that route table in the PREROUTING chain.

It's been a while since I've done this, but that's why I wrote a script to do it
https://github.com/fukawi2/pb-route

Even if you don't use the script, if you disect it a bit then you should get some idea of what you need to do.

EDIT: Don't forget to install 'iproute2' package if you do use my script. Here is an example output: http://pastebin.com/VtGssBYP. Lines 8-27 setup the second routing table, but you also need a lot of the iptables rules to mark the appropriate streams (line 56 to 72) and avoid various problems such as asynchronous routing.

Last edited by fukawi2 (2011-04-13 09:20:44)

autone · 2011-04-13 09:35:17

Wow! Thanks for that. Your script looks like what I need.

Am gonna dive in for a test with it now.

autone · 2011-04-13 10:04:14

fukawi2,

THANK YOU THANK YOU THANK YOU!!!

Your script works wonderfully!

fukawi2 · 2011-04-13 12:07:39

Great, glad to hear that!

Please do let me know if you find any problems or bugs -- its obviously not "release" quality and missing a lot of documentation, but glad it was helpful

autone · 2011-04-13 12:10:27

I actually found an even easier solution.

ip route show

then

ip route change default via

But thanks all the same.

fukawi2 · 2011-04-13 23:18:52

autone wrote:

ip route change default via

That will send all traffic via the new default gateway, not just proxy/port 80 traffic... If I'd known that was an acceptable solution then I would have suggested just changing your default route

autone · 2011-04-14 00:58:39

Yea, it was either all traffic or just proxy traffic. In any case, it is always good to know all the alternatives and that your script exists.

Arch Linux

#1 2011-04-13 04:11:29

Squid / IPtables confusion

#2 2011-04-13 08:22:26

Re: Squid / IPtables confusion

#3 2011-04-13 08:42:49

Re: Squid / IPtables confusion

#4 2011-04-13 09:15:03

Re: Squid / IPtables confusion

#5 2011-04-13 09:35:17

Re: Squid / IPtables confusion

#6 2011-04-13 10:04:14

Re: Squid / IPtables confusion

#7 2011-04-13 12:07:39

Re: Squid / IPtables confusion

#8 2011-04-13 12:10:27

Re: Squid / IPtables confusion

#9 2011-04-13 23:18:52

Re: Squid / IPtables confusion

#10 2011-04-14 00:58:39

Re: Squid / IPtables confusion

Board footer