Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using the following rules in iptables in my network to use a transparent proxy

* iptables -t nat -A PREROUTING -i eth0 -s ! squid-box -p tcp --dport 80 -j DNAT --to squid-box:3128
* iptables -t nat -A POSTROUTING -o eth0 -s local-network -d squid-box -j SNAT --to iptables-box
* iptables -A FORWARD -s local-network -d squid-box -i eth0 -o eth0 -p tcp --dport 3128 -j ACCEPT

But my squid log, always logs gateway IP (172.16.0.1)

Do you know an alternative to not lose client IP? (of course avoid saing manual proxy setup!)

share|improve this question
    
I am a bit confused. Is squid running on your gateway (172.16.0.1)? Can you tell us a bit more about your network. Your rules may be more complex then they really need to be. –  Zoredache Feb 16 '10 at 3:16
    
no squid is running in other host, say 172.16.0.167 for example. With that rules I made it transparent. Hope this helps –  llazzaro Feb 16 '10 at 4:09

3 Answers 3

up vote 0 down vote accepted

I fix the problem installing shorewall at gateway.

share|improve this answer

You can fix this problem by dangling the proxy server off another router interface.

If you do so, you won't need to do the SNAT tricks that cause you to lose the client's IP since all traffic to and from the proxy will be going through the router.

share|improve this answer

Do you know an alternative to not lose client IP?

You are losing the client IP because of the SNAT rule. I am tempted to suggest that you remove that rule. If your squid box is on the inside of your network like your comment implies then I am pretty sure that you should not need to do the SNAT.

Unfortunately you haven't really provided us with much details to go on about how your network is setup. So if SNAT is required for some reason, then you may need to restructure your network.

The other thing to look at is automatic configuration of your clients using Group Policies and/or WPAD. There are some advantages to actually having the browser recognize that a proxy server is in use.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.