I have a network with a broadband connection with dynamic ip address. How do i configure the squid proxy as the isp ip addresses is changing everytime we login. Please click on the following link to view our network diagram http://www.dotweb.in/share
What should be the appropriate IPTABLES commands to enable squid.
Following is our squid.conf file
hierarchy_stoplist cgi-bin ?
acl QUERY urlpath_regex cgi-bin \?
no_cache deny QUERY
hosts_file /etc/hosts
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern . 0 20% 4320
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl purge method PURGE
acl CONNECT method CONNECT
cache_mem 1024 MB
http_access allow manager localhost
http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
acl lan src 192.168.0.1 192.168.2.0/24
http_access allow localhost
http_access allow lan
http_access deny all
http_reply_access allow all
icp_access allow all
visible_hostname myclient.hostname.com
httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_uses_host_head
coredump_dir /var/spool/squid
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Thanks for the quick response.
'ournetwork' is it a generic word which we can use straightaway ?
>iptables -t nat -A POSTROUTING -o eth0 -s <local-network_ip/255.255.2
"local-network_ip" you mean 192.168.0.20 (our local nic ip) ?
"ip of squid-box" its a dynamic ip being allotted every time ... which ip should be this ?
You can also do it this way :
iptables -t nat -A PREROUTING -i eth0 -s ! squid-box -p tcp --dport 80 -j DNAT --to squid-box:3128
iptables -t nat -A POSTROUTING -o eth0 -s local-network -d squid-box -j MASQUERADE iptables -A FORWARD -s local-network -d squid-box -i eth0 -o eth0 -p tcp --dport 3128 -j ACCEPT
Where squid-box = internal ip address of squid server
local network ip means 192.168.0.20 .
ip of squid box means internal ip of your squid box, the one that you set for nic1 i guess it is 192.168.0.20 in ur case as per the diagram.
Im bit confused with this , local ip is 192.168.0.20 , here nic2 is 192.168.0.20 and nic1 is a dynamic ip(external isp ip)
Are these commands correct?
iptables -t nat -A PREROUTING -i eth0 -s ! 192.168.0.20 -p tcp --dport 80 -j DNAT --to 192.168.0.20:3128
iptables -t nat -A POSTROUTING -o eth0 -s local-network -d 192.168.0.20 -j MASQUERADE
iptables -A FORWARD -s local-network -d 192.168.0.20 -i eth0 -o eth0 -p tcp --dport 3128 -j ACCEPT
if i change local-network = 192.168.0.20 , then both source and destination ip's will be 192.168.0.20 ???
Hi,even you have requested to delete the question, you can try it once :
My assumption : eth0 : dynamic IP , eth1 : 192.168.0.20
iptables -t nat -A PREROUTING -i eth1 -s! 192.168.0.20 -p tcp --dport 80 -j DNAT --to 192.168.0.20:3128
iptables -t nat -A POSTROUTING -o eth0 -s 192.168.0.0/255.255.255.0 -d 192.168.0.20 -j MASQUERADE
iptables -A FORWARD -s 192.168.0.0/255.255.255.0 -d 192.168.0.20 -i eth0 -o eth0 -p tcp --dport 3128 -j ACCET
@proman121
As far as I am concerned amitenpal gave working configurations for your problem and he responded to your additional questions - that is he answered your question. If something is unclear ask further questions.
Always assume that there is "no clear clarity" in your questions and that may cause not very clear answers or additional questions from the experts.
For example although you did draw a network diagram (that is very helpful in understanding in your network setup) you failed to mention what interface is connected to the public IP and what to your LAN. Furthermore we still do not know the netmask on your LAN - is it 255.255.255.0?
Oops my delayed reply .. created all this mis-understanding.
Apologies for breaching EE etiquette, it happened inadvertently.
I tried what the expert suggested but thats not working, following is the current status of my problem,
but last few answers by the expert did throw some light on the problem(amitnepal's reply after my question deletion request).
I thank the expert for his sincere efforts in helping me out, there was mis-communication from both ends.. may be for that reason this question could not be closed successfully.
Im awarding the points to the expert for taking pains in solving this problem.
Business Accounts
Answer for Membership
by: amitnepalPosted on 2009-11-02 at 23:36:03ID: 25726699
Hi,
This portion of your squid.conf file is for enabling transparent proxy configuration. Since you are looking for the iptables commands, you should be looking to have transparent proxy . So you are good with this config :
httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_uses_host_head
Then , near this line :
acl localhost src 127.0.0.1/255.255.255.255
put :
acl ournetwork src 192.168.0.0/255.255.255.0
( which means your internal network ) 192.168.0.1 to 192.168.0.254
Now
above this line : http_access allow manager localhost
put :
http_access allow ournetwork
Save the squid.conf file . Your squid configuration is done.
Now for the iptables :
iptables -t nat -A POSTROUTING -o eth0 -s <local-network_ip/255.255.2
then save iptables configuration
You should be good