Arch Linux

rcincx

Member

From: NZ

Registered: 2013-03-22

Posts: 6

Squid transparent proxy: no interwebs from LAN

hi all -

used arch for a while now, but never needed to post before cos of all the great info around here...

having a bit of an issue getting a transparent proxy set up for my home network and would value advice of someone who knows what they're doing; networking as a whole is quite new to me

My goal is to have all devices go through my proxy server so I can do adblocking and content filtering for the kids, and keep an eye on data usage for our boarder (who likes to watch streaming HD content all day long, as well as a few torrents here and there).

My (intended) set up is like this:

interweb -> adsl modem (Draytek vigor 120 in pppoa - pppoe passthrough mode) -> caching proxy server (OSIRIS) -> wireless router (WRT54GL with Tomato) -> LAN devices.

On the server machine OSIRIS I have two NICs:
eth0 (PCI-E r8169 gigabit card) serves the LAN, and eth1 (onboard nvidia NIC) connects to the modem. I have them set up as two profiles for use with netcfg -

eth1 uses a pppoe connection, and becomes ppp0 with an IP address like 27.252.203.xxx, subnet 255.255.255.255, and destination 203.109.128.xxx (not sure how important these addresses are!). Once ppp0 is up I can access the internet directly from OSIRIS.

eth0 profile is like:
IP=static
ADDR=192.168.1.1
NETMASK=255.255.255.0
BROADCAST=192.168.1.5

So eth0 then connects to the router.

In the router settings I have WAN set up as 'static', with
IP=192.168.1.1
SUBNET=255.255.255.0
GATEWAY=192.168.1.1

Under the LAN settings, the router has an IP of 192.168.2.1, and offers addresses in the range 192.168.2.100 - 192.168.2.149. DNS fields are blank.

So when I connect to the router with my laptop, I get an IP address and can then ping 192.168.1.1 (presumably, eth0 on OSIRIS), however I cannot get an internet connection.

So - my presumption is that there is an iptables redirect not working properly on OSIRIS.

as per the wiki advice here I tried to add an iptables PREROUTING entry, but iptables then fails upon restart. I'm also trying Shorewall and using the following configurations (summary of hopefully relevant entries below):

shorewall.conf -

CLAMPMSS=Yes
IP_FORWARDING=On

rules -

DNS(ACCEPT)     $FW     net
SSH(ACCEPT)     loc     $FW
PING(ACCEPT)    net     $FW

ACCEPT  $FW     loc icmp
ACCEPT  $FW     net     icmp
ACCEPT  $FW     net     tcp     www
REDIRECT        loc     3128    tcp     www

policy-

loc     net     ACCEPT
net     all     DROP
$FW     all     ACCEPT
all     all     REJECT

interfaces-

net     ppp0
loc     eth0

Also, potentially relevant changes I made to squid.conf are

acl     localnet src 192.168.2.0/24 192.168.1.0/24
http_access allow localnet
http_port 3128 intercept

If anyone can point me in the right direction of what I'm missing, I'll be very grateful.
thank you.

rcincx

Member

From: NZ

Registered: 2013-03-22

Posts: 6

Re: Squid transparent proxy: no interwebs from LAN

I've been trying to read as much as I can (the arch wiki on iptables, for example) but it just confuses me more......... I followed the link in the https://wiki.archlinux.org/index.php/Ro … on_sharing page to 'stateful firewalls' but something is still wrong with my configuration.

I have a couple of more specific questions, if someone can help:

* I give the LAN card on my server IP address 192.168.2.1. Does my LAN (router and attached devices) then need to have IP addresses in the same subnet?
* I have set my router IP address as 192.168.2.2 in the Tomato firmware, but I cannot ping it from my server machine. Do I need to use dnsmasq or something to actually assign the router this IP address from the server?
* I have set the WAN gateway on my router as 192.168.2.1 but - again - I cannot tell if the router can actually 'see' this IP address. How can I tell?
* Finally, if someone has a similar set up I would be interested to see their iptables.rules file so I can try and get my head around this.

thank you.