Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Im trying to route some traffic on my lan.

I have a squid3 server on and all web traffic is going through squid3. (Transparent via iptables) And now I have a testing server up and running havp on

Squid3 caches, havp checks for malware and virus

Is there a way to "cut" into traffic before it hits my squid server, and pass i through my havp server? havp is setup up to forward traffic back to (non ssl traffic)

This is the iptables syntax I have tried so far:

iptables -t nat -A PREROUTING -i eth3 -p tcp --dport 80 -j REDIRECT --to-destination

And this one:

iptables -t nat -A PREROUTING -i eth3 --dst -p tcp --dport 80 -j REDIRECT --to-port 3127

None of them are working. is setup to accept traffic on port 3127.

If I manually connect to the havp server, It's working like a charm.

My browser -> havp -> squid3 -> internets

What am I doing wrong here?

share|improve this question

Use -I instead of -A

-A appends the rule to the end, -I inserts it at the top. Since you've said it's already acting transparently, you must already have a rule to redirect the traffic to 3128. The first matching rule ends the checks, with your current attempts once the first (original) rule is matched, your second one never gets checked.

A better option is probably to setup havp as a parent proxy to squid.

share|improve this answer
Thanks for the feedback. havp is already parent to squid. And havp takes care of the traffic from havp to squid again. But I have no way to send the traffic from -> (havp) – Andreas Feb 11 '13 at 16:35
[look her for diagram] ( – Andreas Feb 11 '13 at 16:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.