Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I installed SQUID3 on a Linux machine with two ethernet interfaces (eth0 and eth1). I used the default settings in the squid.conf file and uncommented the two lines acl localnet src and http_access allow localnet.

eth0 is connected to a router, which provides Internet access. It is assigned an IP by the router. I manually configured eth1 to have an IP address It is connected to a switch. Systems having IP addresses 192.168.5.x are connected to this switch. I ran these two commands for NAT:

iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j DNAT --to-destination
iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128

But when I try to access internet from a system having IP through the proxy I get an error that says "Access denied". What is wrong with my configuration?

share|improve this question
1) localnet is allowed access before deny all. 2) IPtables is running and configured. – Nitish Oct 21 '10 at 15:09
It looks like the iptables rule is doing something weird, why would you redirect to an exact ip from interface eth1 to an ip configured on the same interface? just a rule like the one you have on eth0 should do the trick, even in the worst case scenario that kind of rule should be alright since the acl will take care of anyone not on your allowed network. Check the squid log files to see which IP is squid denying access to, and if possible activate the verbose logging for further diagnostics. – lynxman Jan 16 '11 at 14:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.