Linux: Setup A Transparent Proxy With Squid in Three Easy Steps

Linux: Setup a transparent proxy with Squid in th...
http://www.cyberciti.biz/tips/linux-setup-transpare...
About Forum Howtos & FAQs Low graphics Shell Scripts RSS/Feed
nixcraft - insight into linux admin work
Linux: Setup a transparent proxy with Squid in three easy steps

by Vivek Gite on May 27, 2006 278 comments Last updated December 5, 2007 Y'day I got a chance to play with Squid and iptables. My job was simple : Setup Squid proxy as a transparent server. Main benet of setting transparent proxy is you do not have to setup up individual browsers to work with proxies.
My Setup:
i) System: HP dual Xeon CPU system with 8 GB RAM (good for squid). ii) Eth0: IP:192.168.1.1 iii) Eth1: IP: 192.168.2.1 (192.168.2.0/24 network (around 150 windows XP systems)) iv) OS: Red Hat Enterprise Linux 4.0 (Following instruction should work with Debian and all other Linux distros) Eth0 connected to internet and eth1 connected to local lan i.e. system act as router.
Server Conguration
Step #1 : Squid conguration so that it will act as a transparent proxy Step #2 : Iptables conguration a) Congure system as router b) Forward all http requests to 3128 (DNAT) Step #3: Run scripts and start squid service First, Squid server installed (use up2date squid) and congured by adding following directives to le:
# vi /etc/squid/squid.conf
1 of 11
Wednesday 29 August 2012 10:56 AM
Modify or add following squid directives:

httpd_accel_host virtual httpd_accel_port 80 httpd_accel_with_proxy on httpd_accel_uses_host_header on acl lan src 192.168.1.1 192.168.2.0/24 http_access allow localhost http_access allow lan
Where, httpd_accel_host virtual: Squid as an httpd accelerator httpd_accel_port 80: 80 is port you want to act as a proxy httpd_accel_with_proxy on: Squid act as both a local httpd accelerator and as a proxy. httpd_accel_uses_host_header on: Header is turned on which is the hostname from the URL. acl lan src 192.168.1.1 192.168.2.0/24: Access control list, only allow LAN computers to use squid http_access allow localhost: Squid access to LAN and localhost ACL only http_access allow lan: -- same as above -Here is the complete listing of squid.conf for your reference (grep will remove all comments and sed will remove all empty lines, thanks to David Klein for quick hint ):
# grep -v "^#" /etc/squid/squid.conf | sed -e '/^$/d'
OR, try out sed (thanks to kotnik for small sed trick)
# cat /etc/squid/squid.conf | sed '/ *#/d; /^ *$/d'
Output:
hierarchy_stoplist cgi-bin ? acl QUERY urlpath_regex cgi-bin \? no_cache deny QUERY hosts_file /etc/hosts refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern . 0 20% 4320 acl all src 0.0.0.0/0.0.0.0 acl manager proto cache_object acl localhost src 127.0.0.1/255.255.255.255 acl to_localhost dst 127.0.0.0/8 acl purge method PURGE acl CONNECT method CONNECT cache_mem 1024 MB http_access allow manager localhost http_access deny manager http_access allow purge localhost http_access deny purge http_access deny !Safe_ports
2 of 11
http_access deny CONNECT !SSL_ports acl lan src 192.168.1.1 192.168.2.0/24 http_access allow localhost http_access allow lan http_access deny all http_reply_access allow all icp_access allow all visible_hostname myclient.hostname.com httpd_accel_host virtual httpd_accel_port 80 httpd_accel_with_proxy on httpd_accel_uses_host_header on coredump_dir /var/spool/squid
Iptables conguration
Next, I had added following rules to forward all http requests (coming to port 80) to the Squid server port 3128 :
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to 192.168.1.1:3128 iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
Here is complete shell script. Script rst congure Linux system as router and forwards all http request to port 3128 (Download the fw.proxy shell script):
#!/bin/sh # squid server IP SQUID_SERVER="192.168.1.1" # Interface connected to Internet INTERNET="eth0" # Interface connected to LAN LAN_IN="eth1" # Squid port SQUID_PORT="3128" # DO NOT MODIFY BELOW # Clean old firewall iptables -F iptables -X iptables -t nat -F iptables -t nat -X iptables -t mangle -F iptables -t mangle -X # Load IPTABLES modules for NAT and IP conntrack support modprobe ip_conntrack modprobe ip_conntrack_ftp # For win xp ftp client #modprobe ip_nat_ftp echo 1 > /proc/sys/net/ipv4/ip_forward # Setting default filter policy iptables -P INPUT DROP
3 of 11
iptables -P OUTPUT ACCEPT # Unlimited access to loop back iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT # Allow UDP, DNS and Passive FTP iptables -A INPUT -i $INTERNET -m state --state ESTABLISHED,RELATED -j ACCEPT # set this system as a router for Rest of LAN iptables --table nat --append POSTROUTING --out-interface $INTERNET -j MASQUERADE iptables --append FORWARD --in-interface $LAN_IN -j ACCEPT # unlimited access to LAN iptables -A INPUT -i $LAN_IN -j ACCEPT iptables -A OUTPUT -o $LAN_IN -j ACCEPT # DNAT port 80 request comming from LAN systems to squid 3128 ($SQUID_PORT) aka transparent proxy iptables -t nat -A PREROUTING -i $LAN_IN -p tcp --dport 80 -j DNAT --to $SQUID_SERVER:$SQUID_PORT # if it is same system iptables -t nat -A PREROUTING -i $INTERNET -p tcp --dport 80 -j REDIRECT --to-port $SQUID_PORT # DROP everything and Log it iptables -A INPUT -j LOG iptables -A INPUT -j DROP
Save shell script. Execute script so that system will act as a router and forward the ports:
# chmod +x /etc/fw.proxy # /etc/fw.proxy # service iptables save # chkconfig iptables on
Start or Restart the squid:

# /etc/init.d/squid restart # chkconfig squid on
Desktop / Client computer conguration

Point all desktop clients to your eth1 IP address (192.168.2.1) as Router/Gateway (use DHCP to distribute this information). You do not have to setup up individual browsers to work with proxies.
How do I test my squid proxy is working correctly?

See access log le /var/log/squid/access.log:
# tail -f /var/log/squid/access.log
Above command will monitor all incoming request and log them to /var/log/squid /access_log le. Now if somebody accessing a website through browser, squid will log information.
Problems and solutions
4 of 11
(a) Windows XP FTP Client All Desktop client FTP session request ended with an error: Illegal PORT command. I had loaded the ip_nat_ftp kernel module. Just type the following command press Enter and voila!
# modprobe ip_nat_ftp
Please note that modprobe command is already added to a shell script (above). (b) Port 443 redirection I had block out all connection request from our router settings except for our proxy (192.168.1.1) server. So all ports including 443 (https/ssl) request denied. You cannot redirect port 443, from debian mailing list, "Long answer: SSL is specically designed to prevent "man in the middle" attacks, and setting up squid in such a way would be the same as such a "man in the middle" attack. You might be able to successfully achive this, but not without breaking the encryption and certication that is the point behind SSL". Therefore, I had quickly reopen port 443 (router rewall) for all my LAN computers and problem was solved. (c) Squid Proxy authentication in a transparent mode You cannot use Squid authentication with a transparently intercepting proxy.
Further reading:
How do I use Iptables connection tracking feature? How do I build a Simple Linux Firewall for DSL/Dial-up connection? Update: Forum topic discussion: Setting up a transparent proxy with Squid peering to ISP squid server Squid, a user's guide Squid FAQ Transparent Proxy with Linux and Squid mini-HOWTO Updated for accuracy.
Tweet 6 Like 128 31
5 of 11
You should follow me on twitter here or subscribe via free e-mail newsletter here.
{ 278 comments read them below or add one } Previous Comments abizar October 25, 2011 at 9:46 am how i can congure Squid as transparent proxy in windows 7 i install squid 2.7stable8 in windows 7 Reply LtPitt October 28, 2011 at 11:51 am Hi all! I have a lovely squid proxy working but my windows clients on the lan cant access using outlook express our mail server (external > on the internet). What can I do to solve the problem? Reply Oleg November 26, 2011 at 12:22 am Hi, I have the same probles of bobzi.. Everything is ne but HTTPS sites dont accept request. When I set Proxy in Internet Option tab, clients can open Secure sites, when I erase the proxy setting only the secure site has a problem Could you please give a solution?! Dear LINUXTITLI or somebody else. I will be grateful. Many thanks Reply are December 23, 2011 at 1:02 pm Dear All, how to disconnect a client connect by proxy squid? Reply Khuram Raza January 2, 2012 at 3:43 pm excellent tip on transparent proxy, but i want to congure parent proxy (cache_peer), any how can i do it with transparent proxy, so far when ever i ran your script my VPN (hamachi) stops
6 of 11
working thus no connection to parent proxy Reply Thura Ko Ko March 15, 2012 at 8:58 pm Hi ~ Khuram Raza . U should run NAT+SQUID . 1 . Service squid stop. #service squid stop 2. NAT Open. #iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE #service iptables save #service iptables restart 3. Test Connection .. Auto Detect in Firefox .. If Run .. Step Complete.. 4. Squid restart # Service squid restart 5. Add Roll on iptables #iptables -t nat -A PREROUTING -i eth1 -p tcp dport 80 -j DNAT to 192.168.1.254:3128 #iptables -t nat -A PREROUTING -i eth1 -p tcp dport 80 -j REDIRECT to-port 3128 #service iptables save #service iptables restart 6.Startup Run #chkcong squid on #chkcong iptables on Reply Thura Ko Ko March 15, 2012 at 9:05 pm 192.168.1.254:3218 is LAN IP and Port ( if u run to u r network port eg: 3218 Now) Reply David January 10, 2012 at 12:46 am I want to setup online/cloud Transparent Proxy Server that will act as a gateway for all my clients PCs internet connections with authentication (e.g; PC MAC, Username & Password.,) to connect with the Proxy Server. Please how possible to setup this proxy server?? Reply Y RCRAO January 22, 2012 at 5:35 am Dear Sir, Plz give the steps how to install squid.conf in RHEL-4 System. Reply alex March 11, 2012 at 11:27 am
7 of 11
Hello guys , thank you very much for this how to guide. I wanned to ask how can i restrict a single IP/client from my lan access to http port (internet browsing) or any other port. My linux box is also a web server, dhcp server + proxy ive changed the rewall script with nixcrafts suggestions in this reply Reply pixel June 22, 2012 at 10:39 am Is there anyway to do the same with SSH ? I have a vpn network and want to allow all the clients who connect via ssh automatically forward to TOR Reply WIN July 11, 2012 at 4:27 am sir, how can i do,now i have proxy server and i need to connect directly with the router, and i need all client pass by proxy server and then pass by router to internet pls help Reply Javi July 31, 2012 at 12:45 pm heres another one grep ^\# le | grep . ;) Reply Zach August 8, 2012 at 8:56 pm I was wondering if there was any helpful advice on turning the iptables command into cong notes when running shorewall? I use shorewall to manage all my rewall activities and since its a top-layer to iptables, I gure there must be a way to translate. I think that is the nal piece I need in getting this to work. Reply Previous Comments Leave a Comment Name *
8 of 11
E-mail * Website
You can use these HTML tags and attributes for your code and commands: <strong> <em> <ol> <li> <u> <ul> <blockquote> <pre> <a href="" title=""> Notify me of followup comments via e-mail. Security Question: What is 5 + 14 ? Solve the simple math so we know that you are a human and not a bot.
Submit
Tagged as: /etc/squid/squid.conf, httpd accel host, httpd accel port, httpd accel uses host header, httpd accel with proxy, httpd accelerator, Iptables, proxy httpd, router server, squid conguration, squid server, transparent proxy
Previous post: MySQL Database Runs 60 to 90 Percent Faster on Solaris 10 Than on Red Hat Linux Next post: Interview: Red Hats open source scholarship challenge
Follow us @ Youtube | Twitter | Google +
9 of 11
To search, type and hit enter
nixCraft on Facebook
Like 23,295 people like nixCraft.
Soumya
Amit
Edmund
Manish
Doa
Jos
Leang
Rakesh
Facebook social plugin
Sysadmin To Be Resources
20 Linux system monitoring tools every sysAdmin should know 20 Linux server hardening security tips Linux: 20 Iptables examples for new sysAdmins My 10 Unix command line mistakes
10 of 11 Wednesday 29 August 2012 10:56 AM
Top 25 PHP security best practices for Sys admins The novice guide to buying a Linux laptop Top 20 OpenSSH server best security practices
Related Posts
Squid Proxy Server Limit the number of simultaneous Web connections from a client with maxconn ACL Install Squid Proxy Server on CentOS / Redhat enterprise Linux 5 nixCraft FAQ Roundup ~ Nov 1, 2007 Top 10 Hits and Zeitgeist of 2006 for your edication and fun Linux Iptables allow SQUID proxy incoming client request
2004-2012 nixCraft. All rights reserved. Cannot be reproduced without written permission. Privacy Policy | Terms of Service | Questions or Comments | Copyright Info | Sitemap
11 of 11

Linux: Setup A Transparent Proxy With Squid in Three Easy Steps

Загружено:

Сведения о документе

Исходное описание:

Оригинальное название

Авторское право

Доступные форматы

Поделиться этим документом

Поделиться или встроить документ

Параметры публикации

Этот документ был вам полезен?

Это неприемлемый материал?

Авторское право:

Доступные форматы

Linux: Setup A Transparent Proxy With Squid in Three Easy Steps

Загружено:

Авторское право:

Доступные форматы

Linux: Setup a transparent proxy with Squid in th...

nixcraft - insight into linux admin work