0

There are a few PCs on LAN so I picked one and set it out as a gateway server, by running Squid on port 3128 (Ubuntu OS) then ran the following 2 commands on it:

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128

(and other PCs gateway dhcp ip are set to this Squid PC IP)

However, when other PCs browse to HTTP websites, the websites do not display but a Squid Error page display saying "The requested URL could not be retrieved" with the URL is : "/"

Squid log:

0 192.168.0.130 NONE/400 3522 GET / - HIER_NONE/- text/html

So I guess Squid could not read the hostname in the request.

Without the iptables command above, all other PCs can read websites fine and they are all working.

So it's not the gateway setup issue, but it's somewhere between iptables or Squid itself not understanding the request routed by iptables.

Was anyone in similar situation before? Any advise on where it went wrong would be really appreciated!!! Took me a day fiddling so far and no clue!!!

Thanks alot!

  • 1
    How did you configure squid? – Michael Hampton Jan 28 '18 at 1:29
  • @MichaelHampton I left the default config as is, except adding "allow all" for testing purpose (I also tested by pointing browser to it, and the browser used Squid fine, no issue at Squid. Prob something with iptables and stuff...) – RyanN Jan 29 '18 at 2:35
  • Definitely a problem with Squid configuration. Old method, simple (what you're trying): wiki.squid-cache.org/ConfigExamples/Intercept/LinuxRedirect . New method, more complex (and example itself is a bit outdated): wiki.squid-cache.org/ConfigExamples/FullyTransparentWithTPROXY . I won't turn this into an answer because well... it's just documentation to read. – A.B Feb 5 '18 at 23:55
  • thanks guys. I've identified the issue from @A.B links... I will turn into an answer for other ppl to know – RyanN Feb 7 '18 at 0:07
0

Solution

put intercept in Squid proxy port config:

http_proxy 3129 intercept

Explaination

We must distinguish between transparent proxy and explicit proxy.

An explicit proxy will require the browser to send the correct header to proxy (i.e. http://proxy:port/http://realwebsite.com/test). This explained why when I pointed the browser to the proxy, it worked; but if I used iptables command above, it didn't!

A transparent proxy, on the other hand, isn't configured at browser/user level, but to be done at routing level (i.e. iptables command above). So when the proxy receives the request, it is actually http://realwebsite.com/test. And if the proxy isn't configured in this mode, what it's doing is retrieving itself http://proxy:port/test

And because my proxy was in explicit mode, not transparent mode, it wouldn't work with iptables command.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.