As explained in the title, I'm trying to set up a Squid Transparent Proxy on a machine separate from the router, and also separate from the private network I want to filter through the proxy.
The context would be like this:
Router Machine runs CentOS 6.0 with iptables policies applied.
WAN interface is eth0. Interface eth3 connects the network that contains the proxy server, and eth2 is the private network interface.
Iptables rules are applied to accept traffic within the private networks.
Squid version is 3.5.2 and is running on CentOS 7.0.
Something important: the proxy works perfectly if configured manually in the client's browser and without the transparent flag in the squid.conf file.
Problems start to arise when I try to make the proxy transparent. This is what I've already tried: On the router's machine I applied the following iptables rule:
$ iptables -t nat -I PREROUTING 1 -i eth2 -s private-ip -p tcp --dport 80 -j DNAT --to squid-ip:3128
I first thought this would be enough since it worked perfectly when configured manually and the only difference now is that I need to redirect the traffic to the squid machine. But it didn't go as I expected.
Running some tests with tcpdump on the router, I realized that without the transparent flag, the proxy machine knows its way to the internet and back to the client's machine through the router (privateIP > router > proxyServer > router > internet | and back again | > router > proxyServer > router > privateIP).
But with the transparent flag the packets only make it through the router and to the proxy and then back again to the client's machine completely ignoring the squid.conf file blocking everything, so, no packet leaves the proxy to go to the internet (privateIP > router > proxyServer > router > privateIP). It seems as if the squid proxy doesn't know what to do with incoming traffic so it can't handle petitions properly now that is set up to be transparent and it is not located on the gateway.
I thought I needed a POSTROUTING rule to perform SNAT and change source address so that the incoming Internet traffic would also go through the proxy but no packet actually leaves to the internet so now I'm stuck.
Perhaps there is something that the squid performs automatically when its not in transparent mode that I need to configure manually when I set it to transparent.
Any help would be appreciated.