I have a Squid Proxy server (Debian) working perfectly with authentication:

auth_param basic program /usr/lib/squid/ncsa_auth /etc/squid/passwd

I'd like that also client that try to get web pages using the proxy as gateway (port 80) get redirected on port 3128.

I've tried iptables:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128

without luck because in that case my port 80 clients get an error:

The following error was encountered:

Invalid Request
Some aspect of the HTTP Request is invalid. Possible problems:

Missing or unknown request method
Missing URL
Missing HTTP Identifier (HTTP/1.0)
Request is too large
Content-Length missing for POST or PUT requests
Illegal character in hostname; underscores are not allowed

so I decided to simply let squid listen on both ports modifying squid.conf: 3128 and 80

http_port 80
http_port 3128

What happens?

A client regularly connecting to 3128 has to enter password and a client without proxy configured (and therefore working on port 80 because the squid is also firewall / router and gateway of our small network) can surf the internet without entering user/pass.

How can I solve the problem?

Iptables or squid.conf I don't care.

  • I am having a difficult time trying to figure out what you want here. – Zoredache Mar 22 '13 at 18:24
  • I want to force all users to authenticate... right now if they disable proxy they can surf freely – Pitto Mar 23 '13 at 8:44

Put the transparent proxy to listen at the 3129 port, and redirect every request to it comming on the 80 port:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3129
iptables -I INPUT -p tcp --dport 3128 -j ACCEPT


http_port 3128
http_port 3129 transparent

This way, transparent proxy will be the default option, and, people that uses it authenticated, have to configure proxy:3128 on their browsers.

  • I understand that this will work but I don't want them to surf the web without authentication... I want to force everyone to authenticate. – Pitto Mar 23 '13 at 21:55
  • It's a limitation and you'll have to chose being transparent or authenticate. To work with both, it needs to be on different ports. You could try NatACL(natacl.sourceforge.net), but it's pretty old stuff – user122772 Mar 25 '13 at 13:04
  • The problem is just... I want to force users to authenticate. Even shutting down ip forwarding for port 80 would be fine but I can't achieve even this result... I tried: iptables -A INPUT -i eth0 -p tcp --dport 80 -j REJECT but they can surf anyway disabling proxy – Pitto Mar 25 '13 at 14:28
  • If you want force users to auth, you'll need to block forward on the 80, and accept the INPUT and make the port forwarding, but you will still need to teach the users how to configure the proxy. – user122772 Mar 25 '13 at 16:38
  • Official documentation about this: wiki.squid-cache.org/Features/… – user122772 Mar 25 '13 at 16:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.