Hi
I am running squid 3.1.15 , kernel version 2.6.32-33-server , Iptables version v1.4.4. I followed the instrcution given on When the client browse using this Squid as gateway, request are getting timed out with following in access.log
1315384947.854 60225 xx.xx.xx.xx TCP_MISS/000 0 GET http://www.google.co.in/url? - DIRECT/www.google.co.in -
1315384949.431 117995 xx.xx.xx.xx TCP_MISS/000 0 GET http://www.google.co.in/url? - DIRECT/www.google.co.in -
where xx.xx.xx.xx are client Public Ips
Following is the squid setup
1) Network configuration
Router ---> squid (eth0 - Public IP) --> Client (Public IP)
sysctl -p
net.ipv4.conf.default.rp_filter = 1
net.ipv4.ip_forward = 1
cat /boot/config-2.6.32-33-server |grep -E '(NF_CONNTRACK=|TPROXY|XT_MATCH_SOCKET|XT_TARGET_TPROXY)'
CONFIG_NF_CONNTRACK=m
CONFIG_NETFILTER_TPROXY=m
CONFIG_NETFILTER_XT_TARGET_TPROXY=m
CONFIG_NETFILTER_XT_MATCH_SOCKET=m
iptables -L -t mangle
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
DIVERT tcp -- anywhere anywhere socket
TPROXY tcp -- anywhere anywhere tcp dpt:www TPROXY redirect 0.0.0.0:3129 mark 0x1/0x1
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
Chain DIVERT (1 references)
target prot opt source destination
MARK all -- anywhere anywhere MARK xset 0x1/0xffffffff
ACCEPT all -- anywhere anywhere
from squid.conf
http_port 3129 tproxy
from dmesg
[62387.197490] nf_conntrack version 0.5.0 (16384 buckets, 65536 max)
[62387.197746] CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use
[62387.197749] nf_conntrack.acct=1 kernel parameter, acct=1 nf_conntrack module option or
[62387.197752] sysctl net.netfilter.nf_conntrack_acct=1 to enable it.
[62387.242358] NF_TPROXY: Transparent proxy support initialized, version 4.1.0
[62387.242362] NF_TPROXY: Copyright (c) 2006-2007 BalaBit IT Ltd.
Browsing is happening fine in transparent mode using http_port 3128 transparent..
Please help....
--
Karthik Vembar
“Condemn none: if you can stretch out a helping hand, do so. If you cannot, fold your hands, bless your brothers, and let them go their own way.” Swami Vivekananda