Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

again here to ask for your help...

This time i need to setup a cluster of 2 squid caching proxies to speedup some apache servers. The good thing is that there is no NAT involed so only direct routing.

Right now I'm able to divert the traffic for specific IP addresses using policy routing on juniper firewalls [the gateway] (if IP dst range within x.x.x.x-x.x.x.x and dest port = 80 then route it trough my squid IP but don't alter the packets itself).

But something that leaves me a bit of troubles is how should i intercept the traffic and alter it so that it's directly taken by the squid box instead of routed to the apache servers. Obviously there is iptables here which I'm not really good at so if you can provide me a bit of help into setting up the rules i would thank you very much

Clearly what i want to achieve is just a transparent caching proxy for HTTP traffic which should speed up a range of IP addresses (multiple servers) using only public IP addresses.

share|improve this question

You want to add iptables rules which catch the same traffic and redirect it to the Squid port on localhost. Something like this should do that:

iptables --table nat --append PREROUTING --destination <apache ip1>,<apache ip2> --protocol tcp --port 80 --jump DNAT --to-destination

The other option is to get the Juniper firewall to perform the DNAT instead of just altering the routing.

share|improve this answer
But doesn't destination NATting alter the packet in such way that it will reply with the squid IP address? – Martino Dino Mar 25 '12 at 20:12
iptables will alter the response packets such that the source IP is the original destination (i.e. the apache server). – mgorven Mar 25 '12 at 23:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.