Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

EDIT: after a day or so, it started happening again and I had to disable iptables for now cause everyone in the family was having no internet.

I route all web traffic from my router ( to my MBL (, which runs on Debian Squeeze and has Squid 3 setup as transparent proxy.

LAN_IP=`nvram get lan_ipaddr`
LAN_NET=$LAN_IP/`nvram get lan_netmask`

iptables -t nat -A PREROUTING -i br0 -s $LAN_NET -d $LAN_NET -p tcp --dport 80 -j ACCEPT 
iptables -t nat -A PREROUTING -i br0 -s ! $PROXY_IP -p tcp --dport 80 -j DNAT --to $PROXY_IP:$PROXY_PORT 
iptables -t nat -I POSTROUTING -o br0 -s $LAN_NET -d $PROXY_IP -p tcp -j SNAT --to $LAN_IP 
iptables -I FORWARD -i br0 -o br0 -s $LAN_NET -d $PROXY_IP -p tcp --dport $PROXY_PORT -j ACCEPT

Yesterday I had forwarding loops with Squid 3 and that somehow solved itself and originally I thought it was cause I put in a new fresh config. But later that day it started again and I checked the cache.log only to find this being spammed over and over:

IpIntercept.cc(137) NetfilterInterception:  NF getsockopt(SO_ORIGINAL_DST) failed on FD 57: (92) Protocol not available

Is this Squid 3 telling me that it can't find the source of the data passing through?

Whats with the NetFilterInterception errors, does the excessive amount cause forwarding loops after some time?

acl manager proto cache_object
acl localhost src
acl to_localhost dst
acl localnet src
acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http


http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports

http_access deny to_localhost
icp_access deny all
htcp_access deny all

http_port 3128 transparent
hierarchy_stoplist cgi-bin ?
access_log /var/log/squid3/access.log squid

#Suggested default:
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern .               0       20%     4320
# Leave coredumps in the first cache dir
coredump_dir /var/spool/squid3

# Allow localnet
http_access allow localnet

## blacklist
acl blacklist dstdom_regex "/etc/squid3/blacklist.txt"
http_access deny blacklist

## disable ads ( http://pgl.yoyo.org/adservers/ )
acl ads dstdom_regex "/etc/squid3/ad_block.txt"
http_access deny ads

# block all other access
http_access deny all
share|improve this question
I switched to Tinyproxy and its all working fine so it has to be a config problem? –  NullBy7e Mar 26 '14 at 14:53
Anyone who can help me? –  NullBy7e Mar 27 '14 at 20:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.