Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm unable to find correct iptables lines for this.

I have a router who has one or more wlan clients (wlan0/10.13.37.x). eth0 is connected to the internet (through other routers). Squid is accessible over VPN (tun0/172.27.0.1).

All http requests passing the router, should be redirected to 172.27.0.1:8080.

Squid is set as transparant proxy.

Thanks

# Generated by iptables-save v1.4.13 on Tue Apr 24 00:45:14 2012
*nat
:PREROUTING ACCEPT [1:328]
:POSTROUTING ACCEPT [3:164]
:OUTPUT ACCEPT [3:164]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Tue Apr 24 00:45:14 2012
# Generated by iptables-save v1.4.13 on Tue Apr 24 00:45:14 2012
*filter
:INPUT ACCEPT [50:6468]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [149:28841]
-A INPUT -i lo -j ACCEPT
-A INPUT -i wlan0 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i wlan0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i tun0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 222 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 2222 -j ACCEPT
-A INPUT -p udp -m udp --dport 123 -j ACCEPT
-A INPUT -i tun0 -p tcp -m tcp --dport 4949 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 0:1023 -j DROP
-A INPUT -p udp -m udp --dport 0:1023 -j DROP
-A INPUT -p tcp -m tcp --dport 4949 -j DROP
-A FORWARD -d 10.13.37.0/24 -i wlan0 -j DROP
-A FORWARD -s 10.13.37.0/24 -i wlan0 -j ACCEPT
-A FORWARD -d 10.13.37.0/24 -i eth0 -j ACCEPT
COMMIT
# Completed on Tue Apr 24 00:45:14 2012
share|improve this question

1 Answer 1

up vote 2 down vote accepted

Pure iptables solution:

# redirect to squid
iptables -t nat -A PREROUTING --src 10.13.37.0/24 -p tcp -m tcp --dport http \
         -j DNAT --to-destination 172.27.0.1:8080

# route clients to squid
sysctl -w net.ipv4.ip_forward=1

iptables -t filter -I FORWARD --src 10.13.37.0/24 --dst 172.27.0.1 \
         -p tcp -m tcp --dport 8080 \
         -j ACCEPT

iptables -t filter -I FORWARD -m conntrack --ctstate ESTABLISHED,RELATED \
         -j ACCEPT

# masquerade (snat) clients in case the VPN doesn't know about the LAN
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

Another solution based on iptables and socat in case you don't want to mess too much with iptables:

iptables -t nat -A PREROUTING --src 10.13.37.0/24 -p tcp -m tcp --dport http \
         -j REDIRECT --to-ports 8080

socat TCP4-LISTEN:8080,bind=127.0.0.1,fork TCP4:172.27.0.1:8080
share|improve this answer
    
Doesn't work. My clients are now unable to access http sites. In chrome: Error 118 (net::ERR_CONNECTION_TIMED_OUT): The operation timed out. –  Tuinslak Apr 19 '12 at 6:00
1  
The rule is fine, you might have a problem with your routes between the VPN endpoint and the local network. What happen if you ping from a workstation to the Squid server? This should work if you want to use that rule. –  diegows Apr 19 '12 at 11:43
    
@Tuinslak: if you setup the proxy explicitly in Chrome (or any other browser) does it work? –  Cristian Ciupitu Apr 19 '12 at 13:43
    
Yes (while not using the VPN ip, but the public IP) –  Tuinslak Apr 19 '12 at 16:24
    
I can indeed not ping the VPN network from a wlan device. –  Tuinslak Apr 19 '12 at 16:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.