Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a squid transparent proxy that's working great.

To save time on client configurations I've decided to redirect port 80 to 3128 so I can configure for all clients the new proxy just changing gateway in dhcp server. It went well, I've used this rule:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128

Now I can surf the internet from clients without problems but it seems I can't open some websites, like gmail.

It loads for ages and then I get a blank page.

If I set manually proxy values in the browser it works without problems. Using port redirection work for some sites but won't work for others...

What's wrong?

edit:

Reading here and there I see that is a common problem solved in various (and difficult) ways like this: http://www.rahulpahade.com/content/squid-transparent-proxy-over-ssl-https

I'd need simple commands so let https traffic go straight to the internet... How can I achieve this?

share|improve this question
    
It seems that your problem is related to https traffic (you mentioned gmail). Is the public IP of proxy server the same as your clients (same NATing)? –  Khaled Feb 23 '12 at 10:29

1 Answer 1

What about packets that leave your LAN through other ports? Are you dropping them?

If yes, I believe you also need to redirect the packets that go through port 443 (https) to the proxy or accept them before you drop the rest.

Also redirect https to the proxy: iptables -t nat -A PREROUTING -i eth0 -p tcp --dports 80,443 -j REDIRECT --to-port 3128

HTTPs going straight to the internet: Before your redirect rule, add this: -A PREROUTING -i eth0 -p tcp -m tcp --dport 443 -j [RETURN or ACCEPT (choosing between return and accept will depend on the rest of your firewall)].

In case you've done that already, try to check the squid logs to see what they say.

Finally, it'd be of great help if you post your all your rules here.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.