Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm hoping someone can help me out - I've been tearing my hair out over this!

I have pptpd and squid set up. I want give these users access to the internet, but would like to send http traffic through a squid proxy.

Hopefully this rough diagram will give you an idea of what I'm trying to achieve:

VPN users connect to pptpd (via eth0)
    \ | /
      |
      |
     / \
 http   everything else
   |     |
   |     |
   |     |
squid    |
   |     |
    \   /
     \ /
      |
     NAT
      |
  internet  (via eth0)

If I set up the following iptables rule, users can connect to the internet:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

I can also connect to squid directly and it works as expected.

Now, I was hoping another simple rule would redirect all http traffic through squid:

iptables -t nat -A PREROUTING -i ppp+ -p tcp --dport 80 -j REDIRECT --to-port 3128

But this doesn't seem to work (I'm also hoping ppp+ is the correct formatting for a wildcard). Http traffic is never redirected and bypasses the proxy.

Can anyone suggest how to get this working?

I don't really know much about this stuff I'm afraid. I would also love some recommendations for ways in which I can debug the system, e.g. which log files to look at, tcpdump commands etc. I find the iptables documentation extremely bewildering!

Thanks!

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

Your rule is correct, you need to check if it is actually being matched.

iptables -t nat -vnL
share|improve this answer
    
Apologies, it was in fact working! I was just being stupid. –  Jack Aug 22 '10 at 17:12
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.