Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I use a linux based router which has dnsmasq and iptables. On a LAN machine I have squid proxy. I want to know if requests for certain urls can be forwarded to the proxy, while other urls are allowed directly to the WAN. For example the request for www.onedomian.com should be forwarded to the proxy by the router.

share|improve this question

2 Answers 2

up vote 1 down vote accepted

You can use iptables to redirect the HTTP requests based on the destination IP (IP of web server) and/or based on the URL (some string) using string matching module.

For example, you can use a rule to forward the requests to the proxy:

$ sudo iptables -t nat -A PREROUTING -s your_client_ip -d your_url_ip -p tcp --dport 80 -j DNAT --to-destination PROXY_IP:PROXY_PORT

Another example using sting matching:

$ sudo iptables -t nat -A PREROUTING -s your_client_ip -p tcp --dport 80 -m string --string "your_url" --algo bm -j DNAT --to-destination PROXY_IP:PROXY_PORT

The normal case will be to forward the requests directly (given that there is no proxy settings in your browser). You just need to setup the default gateway and specify the needed FORWARD rules. The rules above assume using transparent proxying.

If you want to specify a proxy settings in your browser, you can use exception list in the browser to specify the URLs/IPs that are not passed to the proxy server.

share|improve this answer
    
I would got for your second solution. I don't have string match module on my router, instead I have web match module (web_ipt). And I want the settings to be applicable for all the users, so 'your_client_ip' part isn't required. So how can your second solution can be modified to suit my limitations. –  nixnotwin Jan 7 '11 at 15:07
    
Here is more about the weburl module i mentioned above forum.openwrt.org/viewtopic.php?id=17249 –  nixnotwin Jan 7 '11 at 15:14
    
You can specify the netmask for the source IP to be your_clients_subnet/24 to apply it for all users in a certain subnet. The second solution is valid only assuming a collaborative environment. This means all users do what they are told to do. –  Khaled Jan 8 '11 at 7:59
    
It seems that the weburl module is similar to the string module. You can specify the string (url) to be matched in the rule. –  Khaled Jan 8 '11 at 8:07

Yes, using a proxy.pac file, that you can save on your disc or on a http server and then setting it the proxy configuration of your browser.

This is an example found in internet, if you have particular needs let us know.

function FindProxyForURL(url, host)
{
if ((isPlainHostName(host) ||
dnsDomainIs(host, ".noa.com") ||
isInNet(host, "10.0.0.0", "255.0.0.0") ||
isInNet(host, "150.0.0.0", "255.255.0.0") ||
isInNet(host, "192.168.1.0", "255.255.255.0") ||
isInNet(host, "155.16.0.0", "255.255.0.0") ||
isInNet(host, "222.123.76.43", "255.255.255.255") ||
isInNet(host, "222.123.76.24", "255.255.255.255") ||
isInNet(host, "222.223.120.0", "255.255.255.0")) && (
!localHostOrDomainIs(host, "aproxy.noa.com") &&
!localHostOrDomainIs(host, "10.1.80.10") &&
!localHostOrDomainIs(host, "newproxy.noa.com") &&
!localHostOrDomainIs(host, "10.1.1.74") &&
!localHostOrDomainIs(host, "cproxy.proxy.com") &&
!localHostOrDomainIs(host, "10.1.80.11"))) {
return "DIRECT";
}
else if (url.substring(0,16)=="http://localhost")
{
return "DIRECT";
}

else {
return "PROXY your.proxy.com:8080";
}
}
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.