I'm setting up a transparent proxy to a remote proxy server & can't figure out why it doesn't work.
My gateway is tor; it's running Debian unstable, iptables 1.2.11-2, & a custom 2.4.27 kernel. My proxy server is wum; it's also running Debian unstable, squid 2.5.6-8, iptables 1.2.11-2, & a custom 2.6.7 kernel.
Physically, tor is connected by each of 3 NICs to an ADSL modem, to wum by a crossover cable, & to the rest of the network by a hub.
Logically, tor & wum are in 192.168.103.0/24; tor & the rest of the network are in 192.168.179.0/24.
Haven't done something like that myself, but wouldn't it be much simpler to implement it like this (using filter table for filtering, and nat table for NATing, as they were intended to be used):
replace: int_if with tor's internal interface ext_if with tor's external interface wum_if with tor's interface to wum tor_if with wum's interface to tor
On tor: iptables -t nat -A PREROUTING -i int_if -s 192.168.179.0/24 \ -p tcp --dport 80 -j DNAT --to-destination wum:3128 iptables -t nat -A POSTROUTING -o ext_if -s 192.168.0.0/16 -j MASQUERADE iptables -A FORWARD -i int_if -o wum_if -s 192.168.179.0/24 -d wum \ -p tcp --dport 3128 -m state --state NEW -j ACCEPT
On wum: iptables -A INPUT -i tor_if -s 192.168.179.0/24 -d wum \ -p tcp --dport 3128 -m state --state NEW -j ACCEPT
Assuming chains in filter table have default policy set to DROP, and chains in nat&mangle tables to ACCEPT.
These are just hints, you are advised not to cut&paste them into your configuration (tm).
-- Aleksandar Milivojevic <amilivojevic@xxxxxx> Pollard Banknote Limited Systems Administrator 1499 Buffalo Place Tel: (204) 474-2323 ext 276 Winnipeg, MB R3T 1L7
