Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have PF+SQUID31 on FREEBSD-9.0, and I want to have some hosts(aka goodguys) to bypass the proxy, so that torrents are not logged. Also, I am not sure about transparent. It means that I dont have to configure proxy settings on the client side right? I have tried doing a redirect

no rdr on $int_if inet proto {tcp,udp} from 192.168.1.233/32 to any

However, no luck :(

Here is a quick look of my conf files:

SQUID /usr/local/etc/squid/squid.conf

http_port 192.168.1.1:8080 transparent

RC /etc/rc.conf:

gateway_enable="YES"
pf_enable="YES"
pf_rules="/usr/local/etc/pf.conf"
pflog_enable="YES"
squid_enable="YES"

I have squid31 installed from ports with

SQUID_PF "Enable transparent proxying with PF" on

PF /usr/loca/etc/pf.conf:

int_if="re0"
ext_if="bge0"
localnet="{ 192.168.1.0/24 }"

table <goodguys> const { "192.168.1.219", "192.168.1.233" }

set block-policy drop
set skip on lo0

scrub in all fragment reassemble
scrub out all random-id max-mss 1440

block in on $ext_if
pass out on $ext_if keep state

block in on $int_if
pass in on $int_if inet proto tcp from $int_if:network to $int_if port 8080 keep state
pass in on $int_if inet proto udp from $int_if:network to $int_if port 21 keep state
pass in on $int_if inet proto udp from $int_if:network to $int_if port 22 keep state
pass in on $int_if inet proto udp from $int_if:network to $int_if port 53 keep state
pass in on $int_if inet proto tcp from $int_if:network to any port { smtp, pop3 } keep state
pass in on $int_if inet proto icmp from $int_if:network to $int_if keep state
pass out on $int_if keep state

What lines should I add in conf files? I am assuming that the problem is on the firewall(pf).

share|improve this question
    
"Also, I am not sure about transparent. It means that I dont have to configure proxy settings on the client side right?" - Yes, that's correct. Your client, say x.233, needs to be using your squid server as its gateway, or your squid server must also run DNS that the host uses and mangles all DNS to point to the squid server. Can you confirm that the client you're testing with is configured in this way, and is not set to use the squid server as a proxy? –  brent May 3 '12 at 14:48
    
Hi, thanks for the reply! On that proxy server I have one DNS server listed in /etc/resolv.conf and I dont specify them on clients. The only thing I specify in clients is the default gateway which is 192.168.1.1 and in proxy settings of browser I set the proxy to 192.168.1.1:8080. –  epema May 4 '12 at 3:21
1  
I'm not sure what the actual question is here, but you're not doing transparent proxying now, given the configuration files above, so you can't bypass something that doesn't exist... –  Chris S Sep 25 '13 at 2:19
add comment

1 Answer

When you're using squid as a transparent proxy and have it as your hosts gateway (i.e., all of the client traffic passes through this server on its way out of your network), then you don't need to have it as a proxy in your browser. Redirect traffic via pf from port 80 to the squid proxy on 8080 based on whatever your criteria is (e.g., exclude certain hosts)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.