Hi Eliezer,
This is a Ubuntu Trusty 14.04 64 bits, the package is from the APT
repository and there is just one network in both the client and server
side. My aim is to redirect al the outgoing client traffic to the port
3128 on a remote server. So I initially did 2 steps as far as iptables
config goes:
On the client side: iptables -t nat -A OUTPUT -p tcp --dport 80 -j DNAT
--to-destination SQUIDIP:3128
On the server side: iptables -I INPUT -p tcp -d SQUIDIP --dport 3128 -j
ACCEPT
I tried adding this rule:
iptables -t nat -I PREROUTING --match owner --uid-owner proxy -p tcp
--dport 3128 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
But I get a warning like this:
[707317.691686] ip_tables: owner match: used from hooks PREROUTING, but
only valid from OUTPUT/POSTROUTING
However, there's a thing I don't get: When the squid server receives
packets from the clients, they go directly to port 3128. Why should
squid3 also send requests to itself on the same port? Shouldn't they be
redirected to the proper destination?
I also tried disabling iptables (leaving all the chains empty, so the
3128 port is also opened) and still happens the same. Weird...
Any hints?
Thanks!
El 16/07/2014 14:57, Eliezer Croitoru escribió:
Hey Nicolas,
Can we got from step 0 please?
What OS are you running?
Is it a self compiled squid or from the OS repository?
do you have more then one network interface on this machine?
What is the network scheme?
If it's a CentOS machine, can you run this script on it?
http://www1.ngtech.co.il/squid/basic_data.sh
The main issue you have is a looping or wrong redirection.
You need to differentiate any local traffic coming from the local
machine and from squid process to other users and other machines.
depends on your OS you should have an iptables module of owner matching.
you should add it like this:
"iptables -t nat -I PREROUTING --match owner --uid-owner
squid_user_account_name_or_number_id -p tcp --dport 80 -m conntrack
--ctstate NEW,ESTABLISHED -j ACCEPT"
This should solve most of your issues when using the proper intercept
port.
In a case you are trying to reach another destination ports you should
add a special rule to ACCEPT like in the example by owner id and using
the other port.
Eliezer
On 07/15/2014 10:09 PM, Nicolás wrote:
Hi there!
It's been years I haven't played around with squid so I wanted to make a
simple configuration just to see whether I remember the basic things,
and I found two problems:
I'm running:
# squid3 -v
Squid Cache: Version 3.3.8
1) My configuration is the default that the package provides, I just
added another http_port, so now I got:
http_port 3128
http_port 3127 intercept
Afterwards, I setup a REDIRECT iptables rule to make anything
coming to port 8080 be redirected to one of these 2 ports. If I redirect
it to port 3128, everything works fine, squid actually behaves as a
transparent proxy applying the http_access and acl rules correctly. But
if I redirect it to port 3127, any request results in a 111 Connection
refused error. This is the only one rule in my iptables, so it cannot be
related to some rules misconfiguration.
iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 8080
-j REDIRECT --to-ports 312X
I enabled debugging via the -d flag, there's absolutely nothing
regarding to these requests. The access log shows the request like this:
1405450438.913 0 origin.ip TCP_MISS/503 3487 GET
http://www.devels.es/ - HIER_DIRECT/machine.public.ip text/html
So at this point, my questions are 2:
1.1) What could be causing this behavior?
1.2) If the default redirect port (3128) works as a transparent
proxy (intercept), then what's the concept difference between both
configurations?
2) There are some websites using SSL that I cannot reach using squid,
resulting in a 110 Connection timed out error. One of them is Facebook:
pi@rpi ~ $ telnet machine.public.ip 8080
Trying machine.public.ip...
Connected to machine.public.ip.
Escape character is '^]'.
CONNECT www.facebook.com:443
HTTP/1.1 503 Service Unavailable
Server: squid/3.3.8
Mime-Version: 1.0
Date: Tue, 15 Jul 2014 19:00:23 GMT
Content-Type: text/html
Content-Length: 3085
X-Squid-Error: ERR_CONNECT_FAIL 110
Vary: Accept-Language
Content-Language: en
[...]
<p id="sysmsg">The system returned: <i>(110) Connection timed
out</i></p>
<p>The remote host or network may be down. Please try the request
again.</p>
[...]
Connection closed by foreign host.
However, from the server which hosts squid, I can make a wget or
curl request to facebook. I even installed the same version of squid on
a local virtual machine over my computer just to test and it works,
replicating exactly the same both squid and iptables config. What could
be the cause of this?
Thanks for the help!
Regards,
Nicolás
