What I want
I have to implement a very specific setup with squid, dansguardian and nginx. I'm being very specific here on purpose since similar questions often ask for more information to give accurate answers. Also, I don't usually do network stuff and my current solution is the result of picking up puzzle pieces from other Stack Exchange questions and answers, so please excuse/correct any mistakes/misunderstandings I made so far.
Essentially, I want to block any attempts to access the internet through ports 80 and 443, unless said ports are accessed via the proxy on port 3128. The reason for this is so that the proxy and Dansguardian can filter/block undesired webpages. We decided to go with a non-transparent proxy so we can employ the non-invase SSL blocking. This part is already working.
However, if the client tries to access the web directly, instead of dropping the attempt, the Magic Box should redirect the client to a step-by-step guide on how to set up the proxy.
We do have wpad set up to eliminate the need to configure the client's devices manually. However OSX and Linux, and more importantly iOS and Android do not have wpad support enabled by default (or don't support it outright). Our first idea was to leave the client instructions on how to set up their devices on paper. However, my boss wants me to set the redirect variant since it would be better for the client to instantly see why the internet doesn't work right away.
Here's a visual aid to the desired setup. Not pictured is the fact that
enp2s0 are part of the bridge
The network diagram shows all the relevant physical devices. Marked red are the devices we cannot touch or configure. Marked green are our devices.
The diagram "Inside the Magic Box" shows the desired routing decisions
The current situation
Our original ebtables/iptables rules, where we would leave step-by-step config guides on paper, looked like this
ebtables -A FORWARD -p ipv4 -i lo -o enp1s0 --ip-proto tcp --ip-destination-port 80 -j ACCEPT ebtables -A FORWARD -p ipv4 -o enp1s0 --ip-proto tcp --ip-destination-port 80 -j DROP ebtables -A FORWARD -p ipv4 -i lo -o enp1s0 --ip-proto tcp --ip-destination-port 443 -j ACCEPT ebtables -A FORWARD -p ipv4 -o enp1s0 --ip-proto tcp --ip-destination-port 443 -j DROP
In order to allow redirecting the client to a step-by-step guide in-browser when the internet is accessed without proxy, we changed the rules to the following
ebtables -t broute -A BROUTING -i lo -j ACCEPT ebtables -t broute -A BROUTING -p IPv4 --ip-proto tcp --ip-destination-port 80 --ip-destination ! 192.168.2.75 -j redirect --redirect-target DROP iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.2.75:80
With these rules, whenever I try to access the internet directly with a browser, I see these packets showing up in iptable's
PREROUTING chain. Meanwhile, the nginx httpd is still accessible and internet through proxy is also working.
The part that is not working is the redirect to the nginx httpd. The Browser just tells me that the server can't be reached and the nginx access log also doesn't show any activity.
I have tried the following things as well but none have solved the problem
* Setting up
MASQUERADE rules in the
At this point I am beginning to think that I made a mistake so minute that my ignorance on the finer details of ebtables/iptables doesn't allow me to see it, or that what I want to do is simply not possible with iptables/ebtables.