Re: [squid-users] How to set up squid?

Yan Seiner wrote:
> Yan Seiner wrote:
>> Amos Jeffries wrote:
>>> Yan Seiner wrote:
>>>> Amos Jeffries wrote:
>>>>> Yan Seiner wrote:
>>>>>> I have a question about setting up squid in my environment.
>>>>>>
>>>>>> My network is fairly generic:
>>>>>>
>>>>>> a firewall running openwrt, 4 mb flash and 8 mb ram, providing NAT
>>>>>> a server providing DNS and DHCP services; this machine is also
>>>>>> used for terminal services so users are logged in to this machine
>>>>>> directly
>>>>>> assorted clients
>>>>>>
>>>>>> I've had squid set up on a 'opt-in' basis. Now I have a request
>>>>>> to make it transparent for all users with the intent of disabling
>>>>>> web access during specified hours.
>>>>>>
>>>>>> The problem I have is that my firewall is not able to run squid,
>>>>>> and all the examples assume that the squid box is either the
>>>>>> firewall or provides NAT.
>>>>>>
>>>>>> Is it possible, without a huge amount of complications, to run
>>>>>> squid on this sort of setup?
>>>>>>
>>>>>> If so, does anyone have a recipe for doing so?
>>>>>>
>>>>>
>>>>> Squid box had best be the one doing NAT because all source info is
>>>>> lost during NAT interception and Squid needs to look it up. Note I
>>>>> wrote "NAT interception", thats a more correct name for "transparent".
>>>>>
>>>>> Squid does not have to be on the firewall or router to do NAT though:
>>>>> http://wiki.squid-cache.org/ConfigExamples/Intercept/IptablesPolicyRoute
>>>>>
>>>>> the tutorial ironically was written for people using OpenWRT :)
>>>>>
>>>>> Amos
>>>> Hi Amos:
>>>>
>>>> Obvously I got something just half right:
>>>>
>>>>
>>>> The requested URL could not be retrieved
>>>>
>>>> ------------------------------------------------------------------------
>>>>
>>>>
>>>> While trying to retrieve the URL:
>>>> http://arstechnica.com/tech-policy/news/2009/05/landmark-study-drm-truly-does-make-pirates-out-of-us-all.ars
>>>>
>>>>
>>>> The following error was encountered:
>>>>
>>>> Unable to determine IP address from host name for /arstechnica.com/
>>>> The dnsserver returned:
>>>>
>>>> Server Failure: The name server was unable to process this query.
>>>> This means that:
>>>>
>>>
>>> Is it actually using the '/' there?
>>> It looks a lot like the 'transparent' option to http_port is missing
>>> still.
>>>
>>>
>>>>
>>>> I've configured this as best as I can following
>>>>
>>>> http://wiki.squid-cache.org/ConfigExamples/Intercept/IptablesPolicyRoute
>>>> on the firewall/router
>>>> and
>>>> http://wiki.squid-cache.org/ConfigExamples/Intercept/LinuxRedirect
>>>> on the squid box.
>>>>
>>>> As soon as I enable the iptablesPolicyRoute on the fw my DNS fails....
>>>>
>>>> I can't figure out why.... Those rules should only affect tcp
>>>> packets to port 80.
>>>>
>>>> Does anyone have this setup working? Could they please send me some
>>>> instructions for morons?
>>>
>>> That was them ;).
>>>
>>> Does the Squid box have normal DNS if its used as a regular proxy
>>> without the PolicyRouting?
>>>
>>> Amos
>> DUH! OK, my turn to feel stupid....
>>
>> Turns out my firewall rules were blocking forwarding from internal_if
>> to internal_if - so the firewall "loopback" to the squid box was
>> getting dropped.
>>
>> Now everything is OK; on to the next step - time based web access -
>> which is why I started this whole thing!
>>
>> --Yan
>>
>>
>> !DSPAM:4a214d26279661804284693!
>>
> Amos:
>
> Since ordinary mortals like me ;-) apparently cannot edit the wiki,
> here's my final form of the iptables and policy route rules.
>
> First on the firewall:
>
> iptables -t mangle -A PREROUTING -j ACCEPT -p tcp --dport 80 -s squidboxIP
> iptables -t mangle -A PREROUTING -j MARK --set-mark 3 -p tcp --dport 80
> iptables -A FORWARD -i internalif -o internalif -p tcp --dport 80 -j ACCEPT

Is this FORWARDING is not exactly part of the config. I would think
routers should allow internal routes by default anyway. But I'll add it
as a gotcha to be wary of anyway.

> ip rule add fwmark 3 table proxy
> ip route add default via squidboxIP dev internalif table proxy
>
> Then on the squid box itself:
>
> iptables -t nat -A PREROUTING -s localnet/24 -i lan0 -p tcp -m tcp
> --dport 80 -j REDIRECT --to-ports 3128
> iptables -t nat -A OUTPUT -s squidboxIP/32 -p tcp -m owner ! --uid-owner
> squid-user -m tcp --dport 80 -j REDIRECT --to-ports 3128
>
> The first rule catches all of the requests that have been redirected by
> the firewall for proxying.
>
> The second rule catches all of the outbound packets originating on the
> squidbox itself. This can have some weird side effects; my squid box
> also handles several ipcams and so all this traffic is now routed
> through squid. Note that you have to change the uid-owner to the uid of
> the squid process.

This is avoidable if the ipcams are sending traffic to the squid box for
handling anyway. The NAT rules on the squid box need to omit catching
any traffic already destined to itself:

iptables -t nat -A PREROUTING -s SQUIDIP -p tcp --dport 80 -j ACCEPT

as the first rule of the squid box.

Amos

-- 
Please be using
   Current Stable Squid 2.7.STABLE6 or 3.0.STABLE15
   Current Beta Squid 3.1.0.8 or 3.0.STABLE16-RC1