I m trying to make a squid proxy server with to work as a transparent proxy server, and i m facing some issues that i m unable to figure out the reasons. The setup i m using is several VLAN's with specifics "roles" if you say (example: 1 vlan for external/guests devices such as tablets and start phones, other for internal devices such tablets and smartphones, and lastly one for the "normal" desktop and network printers).
These accesses in the vlan's are controlled by an Checkpoint firewall including the internet access, where i have the VLAN i want to use the transparent proxy use a port mapped option to redirect all port 80 traffic from that VLAN to the squid server so i can manage the web access with squid. I drew a little diagram just incase i explained it poorly (sorry my primary language is not English..) 
I'm using a Virtual Machine with 1 NIC with Debian 7.6 installed and compiled squid 3.4.6 from source with the following switches:
#!/bin/sh
'./configure' \
'--build=x86_64-linux-gnu' \
'--srcdir=.' \
'--prefix=/usr' \
'--includedir=/usr/include' \
'--localstatedir=/var' \
'--mandir=/usr/share/man' \
'--infodir=/usr/share/info' \
'--libexecdir=/usr/lib/squid' \
'--datadir=/usr/share/squid' \
'--sysconfdir=/etc/squid' \
'--localstatedir=/var' \
'--bindir=/usr/sbin' \
'--enable-inline' \
'--enable-ssl' \
'--enable-ssl-crtd' \
'--enable-icap-client' \
'--enable-follow-x-forwarded-for' \
'--enable-removal-policies=heap,lru' \
'--enable-delay-pools' \
'--enable-cache-digests' \
'--enable-storeio=ufs,aufs,diskd,rock' \
'--enable-disk-io' \
'--enable-linux-netfilter' \
'--enable-ipf-transparent' \
'--disable-eui' \
'--disable-snmp' \
'--disable-wccp' \
'--disable-wccpv2' \
'--disable-http-violations' \
'--disable-translation' \
'--disable-auto-locale' \
'--disable-htcp' \
'--disable-internal-dns' \
'--with-default-user=proxy' \
'--with-logdir=/var/log/squid/' \
'--with-pidfile=/var/run/squid.pid' \
'--with-filedescriptors=65536' \
'--with-cppunit-basedir=/usr' \
'--with-large-files' \
"$@"
I made a small squid configuration for testing containing the following
http_port 10.5.0.86:3128
http_port 10.5.0.86:8080 intercept
visible_hostname proxyd.domain.com
dns_nameservers 8.8.8.8 8.8.4.4
always_direct allow all
access_log stdio:/var/log/squid/access.log
cache_log /var/log/squid/cache.log
coredump_dir /var/cache/squid
shutdown_lifetime 1 second
acl lan src 10.1.0.3/24
acl pc src 10.2.0.3
http_access allow lan
http_access allow pc
http_access deny all
i have enabled the option of IP Foward in linux by doing the following:
echo "1" > /proc/sys/net/ipv4/ip_forward
Finally i m using IPTABLES rules from the the squid wiki for redirection source:http://wiki.squid-cache.org/ConfigExamples/Intercept/LinuxRedirect:
# Generated by iptables-save v1.4.14 on Fri Aug 29 16:43:22 2014
*mangle
:PREROUTING ACCEPT [2979:777594]
:INPUT ACCEPT [2979:777594]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [2715:858098]
:POSTROUTING ACCEPT [2715:858098]
-A PREROUTING -p tcp -m tcp --dport 8080 -j DROP
COMMIT
# Completed on Fri Aug 29 16:43:22 2014
# Generated by iptables-save v1.4.14 on Fri Aug 29 16:43:22 2014
*nat
:PREROUTING ACCEPT [205:16651]
:INPUT ACCEPT [211:17011]
:OUTPUT ACCEPT [161:9775]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -s 10.5.0.86/32 -p tcp -m tcp --dport 80 -j ACCEPT
-A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080
-A POSTROUTING -j MASQUERADE
COMMIT
# Completed on Fri Aug 29 16:43:22 2014
The issue i m having is when trying to connect from any browser on the port 8080 (witch all 80 traffic is been redirected from that especific VLAN to the squid server) with the intercept mode in the browser i get the error from squid saying "Connection to 10.5.0.86 failed The system returned (111) Connection Refused" and in the squid access.log i get:
32 10.1.0.2 TCP_MISS/503 3942 GET http://www.serverfault.com/ - ORIGINAL_DST/10.5.0.86 text/html
166 10.1.0.2 TCP_MISS/503 3976 GET http://www.squid-cache.org/Artwork/SN.png - ORIGINAL_DST/10.5.0.86 text/html
0 10.1.0.2 TCP_MISS/503 3888 GET http://www.serverfault.com/favicon.ico - ORIGINAL_DST/10.5.0.86 text/html
I have tried several different configurations and i m unable to put the intercept/transparent mode to work properly. just a side note when using a browser and i configure with the port 3128 the proxy works fine.
