I am trying to setup a proxy to filter the internet traffic. In order to do so have arrived at the following combination Client -> Openvpn -> squidproxy -> internet Squid proxy and openvpn have been installed on the same ubuntu server. Installed openvpn though this Digital Ocean tutorial. Openvpn is currently working and routing the traffic correctly to internet. But I have not been able to force the requests to go through squid proxy, even after setting it up to route transparently and adding a few iptables configuration.

I have also added this configuration post which the http requests on port 80 do not reach internet nor reach the squid proxy (http_port 3128 transparent is defined in squid.conf to transparently intercept the request)

-A PREROUTING -i tun0 -p tcp --dport 80 -j DNAT --to
-A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128

Looking at what you've done, I can't see anything wrong - though there are some significant gaps.

A growing proportion of the web is running on HTTPS only. And I would expect an application like Whatsapp to use SSL for all its traffic. While it is possible to relay the SSL traffic on the proxy server (using a simple port forwarder like socat) if you need the capability to monitor the data being exchanged then that's a much more complex proposition. Squid does have the capability to generate SSL certs on the fly and hence decrypt/re-encrypt traffic. But this requires the root CA you are using to be installed on the client devices - which will be rather difficult to do on mobile devices which have not been rooted.

  • Thank you. The primary purpose of the proxy is to filter the content. The only traffic that I am currently not able to process through proxy is whatsapp. Let me explore iptables/firewall rule to allow traffic through for whatsapp and for everything else allow only through the proxy. – ganaraj Apr 22 '16 at 3:44

I suppose you are trying to connect different users to the internet using this combination, right? Are your clients and your server in the same network?

I don't understand why you need to use OpenVPN server for this. Why don't you just setup Squid in your server, and get your clients to use it directly as their proxy server? If they got visibility and the port that you configure into Squid is not filtered by a firewall, it should work. You can even configure Squid to forward requests to a 2nd proxy if needed.

If you still want to user OpenVPN to encrypt your traffic from clients to the server, you still need to configure Squid proxy as your proxy server in your clients. Otherwise they will just connect directly using just the VPN connection.

  • Yes trying to connect users to internet. Users are able to connect to squid directly through the proxy setup, but certain mobile apps like watsapp do not connect through proxy. Hence trying to route all mobile devices to connect through openvpn and then proxy the request forward(to filter the content). The only gateway out of the network is either through the openvpn port(udp 1194) or proxy port (3128), this ensures that direct connection to internet is not possible – ganaraj Apr 21 '16 at 9:21
  • so allow whatsapp through the proxy - creating virtual private networks inside private networks will slow down everything. – Sum1sAdmin Apr 21 '16 at 11:31

I have used the same guide to setup the VPN Squid Proxy to internet. After many days of trying to understand why my squid access logs were empty and after some research I have come to the conclusion that dnat and redirect on Ubuntu do not work. This was borne out by a little googling on the nat not working on Ubuntu seems to be an issue.

I switched to CentOS to retry the effort this still needs a lot of work reinstalling and reconfiguring the penvpn server so after coming across portforwarding with socat I have decided to use socat on my existing Ubuntu install to regain some lost days.

Regarding the comment about the certificates for each client, it is a beautiful and elegant solution to filter traffic to mobile users especially with the use of openvpn's unified ovpn client files which embeds the server and client keys including the hmac key. One tip: finally got the unified format to work with a script from the web called ovpn gen.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.