I'm trying to create a transparent proxy to cache and blacklist traffic on my self-made Linux router. Problem is that all clients are getting timed-out when trying to reach any HTTP sites (HTTPS works).

Here is my setup:

System: Ubuntu 16.04

Proxy: Squid 3.5.12

  - Relevant rule:
   -A PREROUTING -i wlx30b5c21224f3 -p tcp --dport 80 -j REDIRECT --to-port 9999
  - Entire ruleset:

  - Relevant rules:
   http_port intercept
  - Entire config:

  - Internet - enp1s0 (ethernet)
  - Local network - wlx30b5c21224f3 (wireless)

  - Network address -
  - Gateway, DNS, Squid -

Squid logs:
  - Access.log - empty
  - Cache.log - https://pastebin.com/AQ6VFdNP

I can tell that squid is working and listening on assigned ports by looking at active processes.
Result of netstat -tulpn | grep squid:

tcp 0 0* LISTEN 2604/(squid-1)
tcp 0 0* LISTEN 2604/(squid-1)
udp 0 0* 2604/(squid-1)
udp6 0 0 :::50319 :::* 2604/(squid-1)

I can also tell that iptables rule redirects traffic from port 80 to 9999 by watching traffic while trying to connect to HTTP site on one of the clients.
Result of watch 'iptables -t nat -L -n -v': https://pastebin.com/wdRjnBDa

Amount of bytes going through iptables rule keeps increasing as I try to reach the site - yet still client times out.

So my theory is that iptables is redirecting traffic properly and squid is listening on proper ports, yet there is something I'm missing that is preventing traffic from ever reaching Squid. (Since Squid logs are more or less empty)

I've tried a bunch of different iptables rules I found in various Squid guides online - most of them yeld the same result as above. I've also tried a bunch of different ports in Squid, and I've tried to remove ip address from http_port - but that caused squid to listen on ipv6 only (And I'm not sure how that affects iptables rerouting).

PS. This is my firs networking project, so I might be missing something oblivious here.

1 Answer 1


Make sure you open/have another http_port for the reverse proxy:

The reason the SSL works is because it is not going through squid. in this example you can intercept that as well (first line is what you need):

http_port 3130
http_port 3128 intercept
https_port 3129 intercept ssl-bump \
 cert=/etc/squid/certs/squidCA.pem \
 generate-host-certificates=on dynamic_cert_mem_cache_size=4MB


target     prot opt source               destination
REDIRECT   tcp  --              tcp dpt:80 redir ports 3128

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

target     prot opt source               destination
MASQUERADE  all  --  
  • Do I need additional rules in iptables for reverse proxy? Also it looks to me like I already have reverse proxy port set - 8888. Or am I missing something? Nov 1, 2018 at 22:23
  • I do see that you have that correct. Maybe it is your Masquerading? Mine looks slightly different, I have "all" instead a specific host. Chain POSTROUTING (policy ACCEPT) target prot opt source destination MASQUERADE all --
    – chongo2002
    Nov 2, 2018 at 18:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.