Hey, There are no technical details about the relevant subject which is the iptables, iproute and squid.conf I will try to give a demo for such a setup later on. Eliezer ---- Eliezer Croitoru NgTech, Tech Support Mobile: +972-5-28704261 Email: ngtech1ltd@xxxxxxxxx Web: https://ngtech.co.il/ My-Tube: https://tube.ngtech.co.il/ From: squid-users <squid-users-bounces@xxxxxxxxxxxxxxxxxxxxx> On Behalf Of Lola Lo
Sent: Monday, 28 November 2022 6:33
To: Amos Jeffries <squid3@xxxxxxxxxxxxx>; squid-users@xxxxxxxxxxxxxxxxxxxxx
Subject: Re: transparent mode squid on centos 9 with iptables (part 2) Hi Amos. http_access deny cliente_linux sitios2
http_access deny cliente_windows sitios1
http_access allow mi_red these policies work when I set up manually the proxy. Do you have any idea of how to troubleshoot this? On 17/11/2022 9:14 am, Lola Lo wrote:
> Hi guys.
>
>
> Could you please send a tutorial or any good guidance to implement
> squid on transparent mode on centos 9 with iptables.
>
The configuration details for what you appear to be trying to configure
are here:
<https://wiki.squid-cache.org/ConfigExamples/Intercept/LinuxRedirect>
My comments below relate to how your attempt differs and how to fix.
> I have configured squid.conf with this parameters:
>
>
>
> ens192: 172.31.168.28, internet interface
>
> ens224: 192.168.1.10, LAN interface (private network)
>
>
> # Mis ACLs #
>
> acl mi_red src 192.168.1.0/24 <http://192.168.1.0/24>
>
> acl cliente_linux src 192.168.1.20
>
> acl cliente_windows src 192.168.1.30
>
> acl sitios1 url_regex "/etc/squid/listas/sitios1"
>
> acl sitios2 url_regex "/etc/squid/listas/sitios2"
>
>
> # Squid normally listens to port 3128
>
> http_port 3128
>
> http_port 8080 transparent
>
>
Firstly, use "intercept" instead of "transparent" with modern Squid.
Secondly, remember that only port 8080 is setup to receive intercepted
traffic. Port 3128 still receives normal forward-proxy traffic.
> I want the “deny all” rule get applied to test the client using the proxy
>
>
You have not shown any http_access lines from your config. There is a
clear bug in your NAT which explains the behaviour so I will assume that
the squid.conf policy does what you want.
> My iptables is configured as follows:
>
>
> #!/bin/bash
>
>
> ## NAT server configuration ##
>
>
> sysctl -w net.ipv4.ip_forward=1
>
> sysctl -p
>
> iptables -X
>
> iptables -F
>
> iptables -t nat -X
>
> iptables -t nat -F
>
> iptables -I INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
>
> iptables -I FORWARD-m state --state RELATED,ESTABLISHED -j ACCEPT
>
> iptables -t nat -I POSTROUTING -o ens192 -j MASQUERADE
>
>
>
Why is this a different script?
Ideally the firewall rules should be as atomic as possible to avoid
connections being setup with only part of the rules applied.
>
> #!/bin/bash
>
>
> ## proxy server configuration ##
>
>
> ### Accepting traffic for the ports: 3128 and 8080##
>
>
> iptables -A INPUT -s 192.168.1.0/24 <http://192.168.1.0/24> -p tcp
> --dport 3128 -j ACCEPT
>
> iptables -A INPUT -p tcp --dport 3128 -j DROP
>
Do not accept traffic directly to the port 8080. Also Squid does not
make outbound connections from its listening ports.
So these ...
> iptables -A OUTPUT -d 192.168.1.0/24 <http://192.168.1.0/24> -p tcp
> --sport 3128 -j ACCEPT
>
> iptables -A OUTPUT -p tcp --sport 3128 -j DROP
>
>
> iptables -A INPUT -s 192.168.1.0/24 <http://192.168.1.0/24> -p tcp
> --dport 8080 -j ACCEPT
>
> iptables -A INPUT -p tcp --dport 8080 -j DROP
>
> iptables -A OUTPUT -d 192.168.1.0/24 <http://192.168.1.0/24> -p tcp
> --sport 8080 -j ACCEPT
>
> iptables -A OUTPUT -p tcp --sport 8080 -j DROP
>
>
... should be replaced with:
iptables -t mangle -A PREROUTING -p tcp --dport 8080 -j DROP
>
> `### Accepting traffic for the ports: 3128 and 8080##
>
>
> iptables -t nat -A POSTROUTING -o ens192 -j MASQUERADE
>
You are missing a rule to allow Squid outbound traffic to avoid the NAT.
iptables -t nat -A PREROUTING -s 192.168.1.10 -p tcp --dport 80 -j ACCEPT
> iptables -t nat -A PREROUTING -s 192.168.1.0/24
> <http://192.168.1.0/24> -p tcp --dport 80 -j REDIRECT --to-port 8080
>
> iptables -t nat -A PREROUTING -s 192.168.1.0/24
> <http://192.168.1.0/24> -p tcp --dport 443 -j REDIRECT --to-port 8080
>
>
Port 8080 in your squid.conf can only handle port 80 traffic syntax.
Port 443 is a more tricky situation. I recommend removing that until you
have the port 80 working.
>
> But I got this error:
>
>
> 1668381894.7460 192.168.1.20 NONE_NONE/000 0 -
> error:transaction-end-before-headers - HIER_NONE/- -
>
> 1668381967.8000 192.168.1.20 NONE_NONE/400 3690 -
> error:invalid-request - HIER_NONE/- text/html
>
This is likely from the missing NAT rule allowing Squid outbound.
If the above changes do not fix everything make sure that you test
exactly what the real clients will be doing. Specifically that they are
making contact to servers on port 80 or directly to Squid port 3128.
They know *nothing* about port 8080 existence so have no reason to send
anything that way directly.
HTH
Amos
_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users
|
_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users
