Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a computer running debian between the local network and the load balancer who connects to the internet. Everything is fine, that computer has a Squid running inside, BUT we have a problem with VPNs, everyone inside the office can't reach the VPN server, when we remove that computer between the load balancer and the local network everything is fine.

Our debian machine is running squid in transparent mode with bridged configuration to bypass all the data from the load balancer who acts a router too.

I think I need some iptables rule to forward the VPN data

root@squid:~# iptables -vnL
Chain INPUT (policy ACCEPT 225K packets, 182M bytes)
 pkts bytes target     prot opt in     out     source               destination
0 0 ACCEPT udp -- eth1 * 0.0.0.0/0 0.0.0.0/0 udp spts:67:68 dpts:67:68 0 0 ACCEPT udp -- eth0 * 0.0.0.0/0 0.0.0.0/0 udp spts:67:68 dpts:67:68

Chain FORWARD (policy ACCEPT 193K packets, 77M bytes) pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 240K packets, 185M bytes) pkts bytes target prot opt in out source destination

root@squid:~# iptables -vnL -t nat
Chain PREROUTING (policy ACCEPT 7172 packets, 1019K bytes)
 pkts bytes target     prot opt in     out     source               destination
2585 151K REDIRECT tcp -- br0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 redir ports 3128 0 0 REDIRECT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 redir ports 3128 0 0 REDIRECT tcp -- eth1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 redir ports 3128 0 0 REDIRECT tcp -- br0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 redir ports 3128

Chain POSTROUTING (policy ACCEPT 8621 packets, 1092K bytes) pkts bytes target prot opt in out source destination
0 0 MASQUERADE all -- * eth0 0.0.0.0/0 0.0.0.0/0

Chain OUTPUT (policy ACCEPT 1625 packets, 97780 bytes) pkts bytes target prot opt in out source destination

root@squid:~# cat /etc/squid/squid.conf
cache_effective_user squid
cache_effective_user squid
http_port 3128 transparent

cache_dir ufs /home/bridge/squid/cache 2000 16 256

cache_access_log /var/log/squid/access.log cache_log /var/log/squid/cache.log cache_store_log none

emulate_httpd_log on

cache_mem 16 MB

hierarchy_stoplist cgi-bin ? acl QUERY urlpath_regex cgi-bin \? asp aspx jsp no_cache deny QUERY

hosts_file /etc/hosts

refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern . 0 40% 4320

acl all src 0.0.0.0/0.0.0.0

Define your network below

acl mynetwork src 192.168.0.0/24 acl manager proto cache_object acl localhost src 127.0.0.1/255.255.255.255 acl to_localhost dst 127.0.0.0/8 acl purge method PURGE acl CONNECT method CONNECT

acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https

acl Safe_ports port 1025-65535 #unregistered ports

acl SSL_ports port 443 563

http_access allow manager localhost http_access allow manager http_access allow purge localhost http_access allow purge http_access allow !Safe_ports http_access allow CONNECT !SSL_ports

http_access allow localhost http_access allow mynetwork http_access allow all http_reply_access allow all icp_access allow mynetwork

icp_access deny all

visible_hostname bridge

coredump_dir /etc/squid

share|improve this question
add comment

1 Answer

I resolved my problem adding a simple iptables rule:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.