1

We have a squid proxy setup which listens on default port(3128): on eht0 (192.x.x.x).

It has another interface eth1 (10.x.x.x) used to connect to external world. It is doing good quality content filtering using squidguard.

But now we want some of the host in the network to bypass the squid. providing full access to few people.

I am thinking of some thing using iptables: Any packet from those specific host(for which proxy to be by passed) hitting eth0 on port 3128 of the proxy should redirected to eth1 and should be able to access anything.

Will this work? If yes, then please help me with rules?

I know this can be done in good manner using squidgaurd but want to do it with iptables only.

Improve this question
2
  • You did not tell us whether you are using transparent proxying or configured all browsers to use squid as proxy. – Khaled Sep 20 '11 at 12:30
  • Its not a transparent proxy. Need to configure proxy in browsers or globally on system. – tollboy Sep 20 '11 at 12:37
0

You are not going to be able to achieve this unless you are using a transparent proxy - which you are not. With an explicitly configured proxy iptables would only be able to see the conversation between the the client host, and the squid proxy. That would make traffic manipulation impossible because iptables would have no idea what website/IP address you are trying to get to.

You can do it fairly easily the other way around with a transparent proxy however. That is to say have iptables redirect all www traffic to the proxy unless it meets certain criteria.

If using your proxy in transparent mode is an option for you then you can achieve your goal if you follow the guide below, but modify the prerouting stage in iptables to have exceptions just above the proxy redirect. Like so:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -s $PROXY_BYPASS_HOST -j RETURN
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port $SQUID-SERVER:$SQUID_PORT

SQUID/iptables transparent proxy howto

Improve this answer
4
  • Please dont laugh if I am asking totally insane thing. You said: "With an explicitly configured proxy iptables would only be able to see the conversation between the the client host, and the squid proxy." Thats what Iptables just have to see that packet is coming from specific client machine and then it has to redirect it to other interface. Cant it be done? – tollboy Sep 20 '11 at 16:01
  • You also said:"iptables would have no idea what website/IP address you are trying to get to." again the same point we don't have to bothered with the destination of the packet just the but source of the packet.. and redirect to other interface. may be i am wrong, but i am trying to understand. – tollboy Sep 20 '11 at 16:07
  • When the client has the proxy configured then it sends the request to the proxy and the proxy then fetches the requested resource on its behalf. That is to say the packet leaving the client has a source IP of the client, and a destination IP of the proxy. If you redirected these requests past the proxy engine, or out of another interface the destination of the packet would still be the proxy server. You could not have iptables rewrite the destination field because it has no visibility of what the requested resource was. Hope that makes sense! – paulos Sep 20 '11 at 19:25
  • So you mean to say. If I have configured a global system proxy on the client system (for every thing). then every communication from the client will be kinda wrapped up with a proxy header which will be containing the address of proxy as a destination. Rest all information is in that wrapper actual destination and protocol etc. am i right? – tollboy Sep 21 '11 at 4:33
0

It is not going to work because the HTTP "chat" is embedded into the client-proxy session.

However you might config the proxy server as transparent and set the redirect iptables rule as you wish.

Improve this answer
5
  • HTTP chat? Could you please explain this. I dont know any thing about it. :( – tollboy Sep 20 '11 at 13:28
  • HTTP chat = HTTP protocol – migabi Sep 20 '11 at 13:56
  • That's right, if the proxy is no transparent it wont work. Iptables won't be able to manage the proxy headers. – ghm1014 Sep 20 '11 at 13:58
  • Any other way then? I dont want to tocuh squidgaurd configuration..and cant make tranparent. – tollboy Sep 20 '11 at 14:10
  • 1
    Yes.. you can configure the clients browsers NOT to use the proxy. – migabi Sep 20 '11 at 14:43
0

Bypass in Squid transparent mode possible with iptables with range rule.

#NAT:
iptables --table nat --append POSTROUTING --out-interface eth1 -j MASQUERADE
iptables --append FORWARD --in-interface eth0 -j ACCEPT

#Bypass range of ip: 
iptables -t nat -A PREROUTING -i eth0 -m iprange ! --src-range 192.168.3.39-192.168.3.44 -p tcp --dport 80 -j DNAT --to 192.168.3.1:8028
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8028
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.