Transparent Proxy

Hi,
I am network engg (windows), but new for linux. i installed red hat linux 8.0 at one of my customer place as internet
proxy server (squid).
Now internet is working on clients machine on 3128 port.

my network is like this :-

2 ethernet on server
eth0 is directly connected to internet
IP : 62.11.48.42
gateway : 62.11.48.1
subnet : 203.145.6.13
             203.145.6.1
eth1 is connected to local network
ip : 192.168.20.1

I changed in squid.conf file to

httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on httpd_accel_uses_host_header on

and  

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128

i done all setting on client machine, i,e;-
gateway : 192.168.20.1
subnet :203.145.6.13
             203.145.6.1

still iam not getting internet from transparent proxy server

please help me.

Hussain
{{email addr removed by jmcg during cleanup}}
hussain_netAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

_tackCommented:
This line changes the destionation port from 80 to 3128, it will not redirect traffic to your local proxy.
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128

Did you read "Transparent Proxy with Linux and Squid mini-HOWTO", right?

you just missed the section 6, "Transparent Proxy to a Remote Box"

Just in case ...
http://en.tldp.org/HOWTO/TransparentProxy.html
0
brabardCommented:
I don't clear understand the relation between this :
"subnet : 203.145.6.13
             203.145.6.1
"
and your clients settings ?
0
hussain_netAuthor Commented:
Hi,

Thanks, but still i need more help.
Iam using 1 computer for squid and i want to make it as TRANSPARENT PROXY (squid) also
2 ethernets in proxy server(squid)
IP : 62.11.48.42
gateway : 62.11.48.1
subnet : 203.145.6.13
             203.145.6.1
eth1 is connected to local network
ip : 192.168.20.1

and 5 computers(win9x) connected with the same network

i changed the setting in squid.confg files :-
httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on httpd_accel_uses_host_header on

and   iptables

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128

still iam not getting internet on client computers with transparent proxy

note :- internet is working in client computers on port 3128.
 
please help me and write fresh iptables so that i can use my clients computers on transparent proxy. and what chages i have to do in other computers.
0
Become a CompTIA Certified Healthcare IT Tech

This course will help prep you to earn the CompTIA Healthcare IT Technician certification showing that you have the knowledge and skills needed to succeed in installing, managing, and troubleshooting IT systems in medical and clinical settings.

brabardCommented:
"note :- internet is working in client computers on port 3128.
 
"
What do you mean ? The reason of redirecting with iptables requests from 80 to 3128 port is to transport ordinary http requests with 80 dest port through squid . I f your requests are comming with 3128 dst port , they will go to nowhere ...

But I still can't understand your sitution .
1. You said internet is not working in client mashines .
2. You said internet is working on 3128 port in client machines .
???
I am confused , please tell how you confugured the clients in details .
0
hussain_netAuthor Commented:
Hi,
 Sorry for confusion on my questions.
 I installed Red hat linux 8.0 in 1 computer for internet proxy server(squid). 2 ethernets eth0 and eth1 connected to this computer.
eth0  is directly connected with internet(ISP) and eth1 is for local network.
eth0 :-
IP : 62.11.48.42
gateway : 62.11.48.1
subnet : 203.145.6.13
             203.145.6.1
eth1 :-
ip : 192.168.20.1

on client computers iam using win9x and connected with 192.168.20.x network.

I started squid on server
after entering proxy setting in client's browser (http 192.168.20.1 and port 3128) internet is working (on client computers).

Now my aim is - internet should working without changing browser's proxy settings. and i want to redirect 3128 traffic to local proxy.

So, what changes i have to do in squid and what could be the iptables for redirection


Hope now u know what is my problem.

Thanking you
Hussain
0
brabardCommented:
I understood , ok .
Basicly your setting have to be right , but there are 2 possible mistakes .
First is squid is not running in transparent mode and the second is something in your iptables do not allow redirection .
Try setting proxy on browser to 192.168.20.1:80 and see if it works .
Btw , what message return the browser ?
0
brabardCommented:
Actually , after checking the conf , I think all you need is :

http_port 192.168.20.1:10777
acl mynet src 192.168.20.0/255.255.255.0
acl world src 0.0.0.0/0.0.0.0
http_access allow mynet
http_access deny world
httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_uses_host_header on
nonhierarchical_direct off

iptables -t nat -I PREROUTING -p tcp --dport 80 -s 192.168.20.0/24 -j REDIRECT --to-port 10777

Is your config the same ?
0
corposemalmaCommented:
I´m having the same problem on Suse 9.0

Maybe this one can help you in some way (just to change infos):
http://www.experts-exchange.com/Networking/Linux_Networking/Q_20908587.html

Sorry for the interruption...
If you solve it let me know how did you did it!  If I could solve mine I´ll tell you how  = D
0
corposemalmaCommented:
0
moduloCommented:
PAQed with no points refunded (of 125)

modulo
Community Support Moderator
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Linux Networking

From novice to tech pro — start learning today.