Setting up Squid Transparent Proxy on a machine separate from the router

Question

As explained in the title, I'm trying to set up a Squid Transparent Proxy on a machine separate from the router, and also separate from the private network I want to filter through the proxy.

The context would be like this:

• Router Machine runs CentOS 6.0 with iptables policies applied.

• WAN interface is eth0. Interface eth3 connects the network that contains the proxy server, and eth2 is the private network interface.

• Iptables rules are applied to accept traffic within the private networks.

• Squid version is 3.5.2 and is running on CentOS 7.0.

Something important: the proxy works perfectly if configured manually in the client's browser and without the transparent flag in the squid.conf file.

Problems start to arise when I try to make the proxy transparent. This is what I've already tried: On the router's machine I applied the following iptables rule:

$ iptables -t nat -I PREROUTING 1 -i eth2 -s private-ip -p tcp --dport 80 -j DNAT --to squid-ip:3128

I first thought this would be enough since it worked perfectly when configured manually and the only difference now is that I need to redirect the traffic to the squid machine. But it didn't go as I expected.

Running some tests with tcpdump on the router, I realized that without the transparent flag, the proxy machine knows its way to the internet and back to the client's machine through the router (privateIP > router > proxyServer > router > internet | and back again | > router > proxyServer > router > privateIP).

But with the transparent flag the packets only make it through the router and to the proxy and then back again to the client's machine completely ignoring the squid.conf file blocking everything, so, no packet leaves the proxy to go to the internet (privateIP > router > proxyServer > router > privateIP). It seems as if the squid proxy doesn't know what to do with incoming traffic so it can't handle petitions properly now that is set up to be transparent and it is not located on the gateway.

I thought I needed a POSTROUTING rule to perform SNAT and change source address so that the incoming Internet traffic would also go through the proxy but no packet actually leaves to the internet so now I'm stuck.

Perhaps there is something that the squid performs automatically when its not in transparent mode that I need to configure manually when I set it to transparent.

Any help would be appreciated.

Answer 1

I have this setup (or close to it) working currently, but with a few differences. Instead of CentOS, I am using a static route to catch traffic on port 80 to my pfSense gateway and redirect it to another pfSense based box running Squid. The difference with my setup, is when pfSense Squid is set to do transparent proxying, it listens for connections on port 80 instead of the usual 3128. You might run a netstat and see if your Squid is listening on port 80, and try forwarding to that instead.

Good luck.

Answer 2

If there is a direct path between the proxy and clients or via anther router this is what is happening

1. The client sends a packet to google.com (source: local PC, destination: google.com)
2. The gateway receives the packet and replaces the google's IP with that of the proxy (source: local PC, destination: Squid)
3. The Squid server receives the packet, and since it's the 1st packet of a three-way TCP handshake (SYN), it generates a SYN-ACK package (source: Squid, destination: local PC)
4. The Squid server sends the above packet directly to the PC.
5. The local PC receives the SYN-ACK packet from the Squid server, notices that at no time did it ask to speak to this server, and promptly discards the packet.

Steps 1-5 are repeated a few times until the connection eventually times out.