Re: [squid-users] transparent proxy debugging

On 20/04/11 18:19, cc wrote:
> Hi Amos,
>
> Amos Jeffries wrote:
>>> LO_REDIRECT=3129
>>> $IPTB -t nat -A PREROUTING -i $INET_IF -s $INET_IP -p tcp \
>>> --dport $HTTP -j ACCEPT
>>> $IPTB -t nat -A PREROUTING -i $DMZ_IF -p tcp -s $LAN_NET --dport $HTTP \
>>> -j REDIRECT --to-ports $LO_REDIRECT
>>> $IPTB -t nat -A POSTROUTING -o $INET_IF -p tcp -j MASQUERADE
>>> $IPTB -t mangle -A PREROUTING -p tcp --dport $LO_REDIRECT -j DROP
>>>
>>> squid.conf:
>>>
>>> http_port 3129 transparent
>>>
>>> (are there other options that I need to consider?)
>>>
>>> From within the LAN_NET, I get a time out error.
>>
>> You are missing the rule which prevents packets leaving Squid from being
>> looped back into Squid again.
>>
>> You seem to have one preventing external (WAN) traffic from being NAT'd
>> into Squid instead.
>>
>> Try this:
>>
>> $IPTB -t nat -A PREROUTING -i $INET_IF -s $INET_IP -p tcp \
>> --dport $HTTP -j ACCEPT
>>
>> $IPTB -t nat -A PREROUTING -s $SQUID_IP -p tcp --dport 80 -j ACCEPT
>>
>> $IPTB -t nat -A PREROUTING -i $DMZ_IF -p tcp \
>> -s $LAN_NET --dport $HTTP \
>> -j REDIRECT --to-ports $LO_REDIRECT
>
> In my case, wouldn't $SQUID_IP = $INET_IP?

Only if the first of those rules is broken.

  ... -i $INET_IF -s $INET_IP matches traffic from another machine
called $INET_IP outside the current box.

Amos

-- 
Please be using
   Current Stable Squid 2.7.STABLE9 or 3.1.12
   Beta testers wanted for 3.2.0.7 and 3.1.12.1