Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have configured a squid transparent tproxy. All works fine.

Now I need all the traffic going to an external IP (internet) does not pass through the proxy.

Do I need to modify iptables, ebetables rules or change the configuration of squid?

I found this tutorial, but it doesn't use the tproxy rules.

iptables rules:

iptables -F -t mangle
iptables -X -t mangle
iptables -t mangle -N DIVERT
iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT

iptables -t mangle -A DIVERT -j MARK --set-mark 1
iptables -t mangle -A DIVERT -j ACCEPT

iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129

ebtables rules:

ebtables -t broute -A BROUTING -i eth1 -p ipv4 --ip-proto tcp --ip-dport 80 -j redirect --redirect-target DROP
ebtables -t broute -A BROUTING -i eth0 -p ipv4 --ip-proto tcp --ip-sport 80 -j redirect --redirect-target DROP

Looks like I need to insert the bypass rules before the first ebtables rule. Is that correct?

Do these rules works?

ebtables -t broute -A BROUTING -i eth1 -p ipv4 --ip-proto -d IP_dest -j ACCEPT
ebtables -t broute -A BROUTING -i eth0 -p ipv4 --ip-proto -s IP_dest -j ACCEPT
share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.