RE: [squid-users] transparent proxy

Hello,

I am getting exactly the same outcomes as PayalR. Weird... can anyone try to
help me... i have got my squid installed 2.4.STABLE7
with --enable-linux-netfilter. Also the necessary options in the squid.conf
have been enabled and the port value i have used for httpd_accel_port is 80.

TIA

Kamesh

-----Original Message-----
From: Jan Humme [mailto:jan.humme@xs4all.nl]
Sent: 19 August 2002 19:46
To: PayalR; squid-users@squid-cache.org
Subject: Re: [squid-users] transparent proxy

On Monday 19 August 2002 14:53, PayalR wrote:
> Hi all,
> I want to use squid as a transparent proxy. So, I read a few docs
> including white paper of visolve and did accordingly. I use Mandrake Linux
> 8.2 with default kernel 2.4.18-6mdk.
>
> Here are the steps I followed.
> 1. I installed squid-2.4.STABLE1 using tar.gz with options
> ./configure --enable-linux-netfilter
> [ here I found that makefile created with ./configure
> --enable-linux-netfilter and just ./configure didn't have any difference ]
>
> 2. I edited the squid.conf properly to suit my requirements and started
> squid. It was working proeprly, a fact which I saw from access.log.

Just in case (so this 100% clear to me): did you verify that squid was in
fact running properly, eg. by configuring another PC in the network to use
this PC as a proxy server (non-transparant proxying)?

If so: the problem seems to be with netfilter.

> 3. Then,
> echo 1 > /proc/sys/net/ipv4/ip_forward
> iptables -t nat -A PREROUTING -p TCP --dport 80 -j REDIRECT --to-port 3128
>
> 4. My rules were correct which was verified by,
> #iptables -t nat -L
> Chain PREROUTING (policy ACCEPT)
> target prot opt source destination
> REDIRECT tcp -- anywhere anywhere tcp dpt:http
> redir ports
> 3128
>
> Chain POSTROUTING (policy ACCEPT)
> target prot opt source destination
>
> Chain OUTPUT (policy ACCEPT)
> target prot opt source destination

Looks all perfectly OK to me.

> 5. Then I tried to browse without setting the cache in browser (links)
> settings. I could browse alright, but squid's logs were not getting
filled.
> That meant squid was not being used.

So the first thing to figure out is:
=> is the problem with netfilter, or
=> is the problem with squid

Now assuming that you have verified that squid is running properly as a
non-transparant proxy-server, add some logging rules to see if your rule is
being used, eg.

iptables -t nat -I PREROUTING -j LOG --log-prefix "Before proxy redirect: "
iptables -t nat -A PREROUTING -j LOG --log-prefix "After proxy redirect: "

Try to connect to a web-site and monitor your syslogger (eg. "tail -f
/var/log/messages") to see where the packets go.

Oh, yes: before doing all of this, type "cat /proc/sys/net/ipv4/ip_forward"
to check this kernel parameter; and remember that in many Linux flavors (eg.
RH7.x) it will be reset to 0 every time the system is rebooted or the
network
is brought down!

JH.
Received on Tue Aug 20 2002 - 03:34:50 MDT