What I want

I have to implement a very specific setup with squid, dansguardian and nginx. I'm being very specific here on purpose since similar questions often ask for more information to give accurate answers. Also, I don't usually do network stuff and my current solution is the result of picking up puzzle pieces from other Stack Exchange questions and answers, so please excuse/correct any mistakes/misunderstandings I made so far.

Essentially, I want to block any attempts to access the internet through ports 80 and 443, unless said ports are accessed via the proxy on port 3128. The reason for this is so that the proxy and Dansguardian can filter/block undesired webpages. We decided to go with a non-transparent proxy so we can employ the non-invase SSL blocking. This part is already working.

However, if the client tries to access the web directly, instead of dropping the attempt, the Magic Box should redirect the client to a step-by-step guide on how to set up the proxy.

We do have wpad set up to eliminate the need to configure the client's devices manually. However OSX and Linux, and more importantly iOS and Android do not have wpad support enabled by default (or don't support it outright). Our first idea was to leave the client instructions on how to set up their devices on paper. However, my boss wants me to set the redirect variant since it would be better for the client to instantly see why the internet doesn't work right away.

Here's a visual aid to the desired setup. Not pictured is the fact that enp1s0 and enp2s0 are part of the bridge br0.

Desired setup

The network diagram shows all the relevant physical devices. Marked red are the devices we cannot touch or configure. Marked green are our devices.

The diagram "Inside the Magic Box" shows the desired routing decisions

The current situation

Our original ebtables/iptables rules, where we would leave step-by-step config guides on paper, looked like this

ebtables -A FORWARD -p ipv4 -i lo -o enp1s0 --ip-proto tcp --ip-destination-port 80 -j ACCEPT
ebtables -A FORWARD -p ipv4 -o enp1s0 --ip-proto tcp --ip-destination-port 80 -j DROP
ebtables -A FORWARD -p ipv4 -i lo -o enp1s0 --ip-proto tcp --ip-destination-port 443 -j ACCEPT
ebtables -A FORWARD -p ipv4 -o enp1s0 --ip-proto tcp --ip-destination-port 443 -j DROP

In order to allow redirecting the client to a step-by-step guide in-browser when the internet is accessed without proxy, we changed the rules to the following

ebtables -t broute -A BROUTING -i lo -j ACCEPT
ebtables -t broute -A BROUTING -p IPv4 --ip-proto tcp --ip-destination-port 80 --ip-destination ! -j redirect --redirect-target DROP
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination

With these rules, whenever I try to access the internet directly with a browser, I see these packets showing up in iptable's PREROUTING chain. Meanwhile, the nginx httpd is still accessible and internet through proxy is also working.

The part that is not working is the redirect to the nginx httpd. The Browser just tells me that the server can't be reached and the nginx access log also doesn't show any activity.

I have tried the following things as well but none have solved the problem
* Setting up SNAT and MASQUERADE rules in the POSTROUTING chain
* Setting net.ipv4.ip_forward to 1
* Setting net.ipv4.conf.all.route_localnet to 1

At this point I am beginning to think that I made a mistake so minute that my ignorance on the finer details of ebtables/iptables doesn't allow me to see it, or that what I want to do is simply not possible with iptables/ebtables.


All you have to do is to point all the traffic on port 80 to specific IP address and port. Right? If so :

iptables -A PREROUTING -s ! -d -p tcp -m tcp --dport 80 -j DNAT --to-destination

Where --to-destination is the ip of your squid server.

|improve this answer|||||
  • I have tried the following command iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination, which does not work and should be broader. Also, I am trying to redirect traffic to the nginx httpd on port 80, not to the squid server. This is done to show on-screen instructions on how to config the proxy since the squid-server is being run as a non-transparent proxy. – Mike Oct 20 '16 at 6:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.