July 12, 2009 by Ivan

[HowTo] Install and Configure Squid as Transparent Proxy

Ads by Google

Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. It reduces bandwidth and improves response times by caching and reusing frequently-requested web pages. Squid has extensive access controls and makes a great server accelerator.

An intercepting proxy (also known as a “transparent proxy“) combines a proxy server with a gateway. Connections made by client browsers through the gateway are redirected through the proxy without client-side configuration (or often knowledge). Sothe client never realize and don’t have to configure the client machine to use the proxy, but they are using it.

Install Squid Cache Proxy
I will show you how to install Squid Web Proxy (*only for Ubuntu/Debian):
1. Open up your shell and type this command:
sudo apt-get install squid
2. Finish.
For other OS you can download the binary package here.

Configure Squid Cache Proxy as Transparent Proxy
To configure squid proxy as transparent proxy you need to edit squid.conf file in /etc/squid/squid.conf as follow:

acl all src all
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl localnet src 192.168.1.0/24
 
acl SSL_ports port 443 563
acl Safe_ports port 80        # http
acl Safe_ports port 21        # ftp
acl Safe_ports port 443        # https
acl Safe_ports port 70        # gopher
acl Safe_ports port 210        # wais
acl Safe_ports port 1025-65535    # unregistered ports
acl Safe_ports port 280        # http-mgmt
acl Safe_ports port 488        # gss-http
acl Safe_ports port 591        # filemaker
acl Safe_ports port 777        # multiling http
acl CONNECT method CONNECT
 
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
 
http_access allow localnet
http_access allow localhost
http_access deny all
 
http_reply_access allow localnet
http_reply_access deny all
 
icp_access allow localnet
icp_access deny all
 
http_port 8080 transparent
 
hierarchy_stoplist cgi-bin ?
 
cache_mem 256 MB
cache_dir ufs /var/spool/squid 2048 16 256
cache_mgr admin@email.com
cache_effective_user squid
cache_effective_group squid
 
access_log /var/log/squid/access.log squid
 
refresh_pattern ^ftp:        1440    20%    10080
refresh_pattern ^gopher:    1440    0%    1440
refresh_pattern (cgi-bin|\?)    0    0%    0
refresh_pattern .        0    20%    4320
 
visible_hostname yourdomain.com
 
icp_port 3130
 
always_direct    allow    all
 
forwarded_for off
 
coredump_dir /var/spool/squid

The most important line is
“http_port 8080 transparent” : This line means, Squid proxy run as transparent proxy at port 8080 (by default 3128). Later you need to edit the iptables to bypass every request/response connection through this port.
Note: That setting is for Squid v2.6 or v2.7. For later version like Squid v3.1, “transparent” option is being deprecated, you need to use option “intercept” instead.

There are many things that squid can do, like limiting download speed for certain ip, denied some “time wasting” sites, denied some ports, denied download some files in certain hours, and many more case that you can name. So take your time to read their documentation guide here.

Configure Iptables
To make Squid as the transparent proxy (“man in the middle”), you need to configure the iptables. I got this script to help you:

#!/bin/sh
# ------------------------------------------------------------------------------------
# See URL: http://www.cyberciti.biz/tips/linux-setup-transparent-proxy-squid-howto.html
# (c) 2006, nixCraft under GNU/GPL v2.0+
# -------------------------------------------------------------------------------------
# squid server IP
SQUID_SERVER="192.168.1.1"
# Interface connected to Internet
INTERNET="eth0"
# Interface connected to LAN
LAN_IN="eth1"
# Squid port
SQUID_PORT="3128"
 
# DO NOT MODIFY BELOW
# Clean old firewall
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
# Load IPTABLES modules for NAT and IP conntrack support
modprobe ip_conntrack
modprobe ip_conntrack_ftp
# For win xp ftp client
#modprobe ip_nat_ftp
echo 1 &gt; /proc/sys/net/ipv4/ip_forward
# Setting default filter policy
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
# Unlimited access to loop back
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# Allow UDP, DNS and Passive FTP
iptables -A INPUT -i $INTERNET -m state --state ESTABLISHED,RELATED -j ACCEPT
# set this system as a router for Rest of LAN
iptables --table nat --append POSTROUTING --out-interface $INTERNET -j MASQUERADE
iptables --append FORWARD --in-interface $LAN_IN -j ACCEPT
# unlimited access to LAN
iptables -A INPUT -i $LAN_IN -j ACCEPT
iptables -A OUTPUT -o $LAN_IN -j ACCEPT
# DNAT port 80 request comming from LAN systems to squid 3128 ($SQUID_PORT) aka transparent proxy
iptables -t nat -A PREROUTING -i $LAN_IN -p tcp --dport 80 -j DNAT --to $SQUID_SERVER:$SQUID_PORT
# if it is same system
iptables -t nat -A PREROUTING -i $INTERNET -p tcp --dport 80 -j REDIRECT --to-port $SQUID_PORT
# DROP everything and Log it
iptables -A INPUT -j LOG
iptables -A INPUT -j DROP

Okay, that’s all of it. If you like it please leave me a comment.

What people search:

Article by Ivan Kristianto

Ivan Kristianto is a freelancer web developer and blogger. He started to blog since November 2007. He start this site since April 2008. With bachelor of Engineering degree background he writes articles in IT related field and share through this blog.

Tags: centos squid web proxy, faster internet, how to, linux, proxy, squid, squid transparent proxy howto, transparent proxy, web cache, web proxy
Category: Ubuntu

Emre

Hi,

I'm configuring my iptables and squid proxy like your's. But can't be transparent, sorry for my english.

I have two ethernet karts and eth1 > internet, eth0>LAN

configured them for my network but still runing normal proxy, not transparent.
Please help, and so thanks!
Emre

Hi,

I’m configuring my iptables and squid proxy like your’s. But can’t be transparent, sorry for my english.

I have two ethernet karts and eth1 > internet, eth0>LAN

configured them for my network but still runing normal proxy, not transparent.
Please help, and so thanks!
Anonymous

Hi Emre, there are some point you need to configure:
1. Please be sure this line is in your squid.conf
"http_port 8080 transparent" (without quotes), that's mean you run squid on port 8080 as transparent.
2. You need to configure the iptables script:
SQUID_SERVER="192.168.1.1" => your squid's ip
INTERNET="eth0" => your ethernet that go to the internet
LAN_IN="eth1" => your ethernet that go to the your network
SQUID_PORT="3128" => the squid's port 3128 is the default squid port, for my example use 8080

Hope this help you. Cheers.
Ivan
http://www.ivankristianto.com Ivan

Hi Emre, there are some point you need to configure:
1. Please be sure this line is in your squid.conf
“http_port 8080 transparent” (without quotes), that’s mean you run squid on port 8080 as transparent.
2. You need to configure the iptables script:
SQUID_SERVER=”192.168.1.1″ => your squid’s ip
INTERNET=”eth0″ => your ethernet that go to the internet
LAN_IN=”eth1″ => your ethernet that go to the your network
SQUID_PORT=”3128″ => the squid’s port 3128 is the default squid port, for my example use 8080

Hope this help you. Cheers.
Ivan
kevin

how i can install anonymous proxy….
please help me with my config….

please make complete tutorial…

or just email me…
kevin

how i can install anonymous proxy….
please help me with my config….

please make complete tutorial…

or just email me…
Anonymous

Hi Kevin,
To install squid as anonymous proxy,
you can do the following:
1. disable all log, edit your squid.conf to:
access_log none
cache_store_log none
2. you need to have a public ip and allow any ip you like, edit the squid.conf:
acl IPALLOW 210.83.0.0/19 (Note you can add as many ip you like here)
http_access allow IPALLOW
http_access deny all
3. Then you need to edit this line in squid.conf:
visible_hostname <your public IP>
4. restart your squid.
http://www.ivankristianto.com Ivan

Hi Kevin,
To install squid as anonymous proxy,
you can do the following:
1. disable all log, edit your squid.conf to:
access_log none
cache_store_log none
2. you need to have a public ip and allow any ip you like, edit the squid.conf:
acl IPALLOW 210.83.0.0/19 (Note you can add as many ip you like here)
http_access allow IPALLOW
http_access deny all
3. Then you need to edit this line in squid.conf:
visible_hostname
4. restart your squid.
clive

How do I connect(physical) the transparent proxy server in my network? I have a DSL modem and a LinkSys wireless router.
clive

How do I connect(physical) the transparent proxy server in my network? I have a DSL modem and a LinkSys wireless router.
Anonymous

If you have a router with squid transaprent proxy installed, just point your computer gateway and dns to your router ip.
http://www.ivankristianto.com Ivan

If you have a router with squid transaprent proxy installed, just point your computer gateway and dns to your router ip.
Siva

Hi all,
Can someone give me the configuration guide to make a Squid transparent proxy in Vista OS. I have tried but not succeeded.
Please guide me the Ethernet configuration(iptables script) on Vista also.

My network: DNS Modem –> [T-Proxy] –> Swtich –> Client machines

Thanks in advance,
Siva
Siva

Hi all,
Can someone give me the configuration guide to make a Squid transparent proxy in Vista OS. I have tried but not succeeded.
Please guide me the Ethernet configuration(iptables script) on Vista also.

My network: DNS Modem –> [T-Proxy] –> Swtich –> Client machines

Thanks in advance,
Siva
Siva

Hi,
Can someone give the configuration steps of Squid Transparent proxy in Vista.
I have tried, but not able to succeed. Please give the ethernet NIC (iptable similar for Win) configuration info for Vista.

Thanks in advance,
Siva
Siva

Hi,
Can someone give the configuration steps of Squid Transparent proxy in Vista.
I have tried, but not able to succeed. Please give the ethernet NIC (iptable similar for Win) configuration info for Vista.

Thanks in advance,
Siva
Anonymous

Hi Siva,
i haven't tried yet. But why do you want make your vista as cache server? isn't that waste to much resources?
http://www.ivankristianto.com Ivan

Hi Siva,
i haven’t tried yet. But why do you want make your vista as cache server? isn’t that waste to much resources?
Siva

Thanks for the reply..! Yes you are right. I changed my plan now.
Could you please tell me, can we install Squid Transparent proxy in "CentOS" if yes, please tell me which version I should download and configure.

Note: All my clients are running Vista. Guide me in IP setting also, we've one DNS Static IP.

My Network: DNS Modem –> [T-Proxy server] –> Swtich –> Client machines

Please aid me in the Ethernet card configuration.
Siva

Thanks for the reply..! Yes you are right. I changed my plan now.
Could you please tell me, can we install Squid Transparent proxy in “CentOS” if yes, please tell me which version I should download and configure.

Note: All my clients are running Vista. Guide me in IP setting also, we’ve one DNS Static IP.

My Network: DNS Modem –> [T-Proxy server] –> Swtich –> Client machines

Please aid me in the Ethernet card configuration.
Anonymous

Hi Siva,
Just follow my guide in this article, it also work for CentOS.
But replace command "apt-get install squid" to "yum install squid" (without quotes). It will install squid v2.6 STABLE21.
And the rest configuration is same.
Good luck.
http://www.ivankristianto.com Ivan

Hi Siva,
Just follow my guide in this article, it also work for CentOS.
But replace command “apt-get install squid” to “yum install squid” (without quotes). It will install squid v2.6 STABLE21.
And the rest configuration is same.
Good luck.
Siva

Ivan, I have done all the configuration, but my Squid access.log is not populating.

And tell me do i need to configure DHCP in my squid server?
Siva

Ivan, I have done all the configuration, but my Squid access.log is not populating.

And tell me do i need to configure DHCP in my squid server?
Anonymous

You don't need to configure DHCP in your squid.
Did you miss iptables config?
http://www.ivankristianto.com Ivan

You don’t need to configure DHCP in your squid.
Did you miss iptables config?
Santy

Hi,

Thanks for info…

My current setup is
my two desktop machines gateway is CISCO PIX (IP 192.168.10.1) & DNS is my AD & DNS Server (192.168.10.10).. Currently I am running squid with manual proxy configuration….for squid as transparent proxy is it required to add rules on PIX firewall? to forward port 80 traffic to squid port 3128.. or is it required to change gateway of my all desktop machines to Squid proxy server IP? (192.168.10.20) please suggest…thanks in advance..

is it ok if I use eth0 & eth1 password from same subnet (e.g 192.168.10.5 & 192.168.10.6 for eth0 & eth1 respectively) for squid transparent proxy)
Santy

Hi,

Thanks for info…

My current setup is
my two desktop machines gateway is CISCO PIX (IP 192.168.10.1) & DNS is my AD & DNS Server (192.168.10.10).. Currently I am running squid with manual proxy configuration….for squid as transparent proxy is it required to add rules on PIX firewall? to forward port 80 traffic to squid port 3128.. or is it required to change gateway of my all desktop machines to Squid proxy server IP? (192.168.10.20) please suggest…thanks in advance..

is it ok if I use eth0 & eth1 password from same subnet (e.g 192.168.10.5 & 192.168.10.6 for eth0 & eth1 respectively) for squid transparent proxy)
Santy

is it ok if I use eth0 & eth1 IP Address from same the subnet (e.g 192.168.10.5 & 192.168.10.6 for eth0 & eth1 respectively) for squid transparent proxy)
Santy

is it ok if I use eth0 & eth1 IP Address from same the subnet (e.g 192.168.10.5 & 192.168.10.6 for eth0 & eth1 respectively) for squid transparent proxy)
Siva

No I ran it, but I don't know how to check it out… Can u please give me the configurations for squid as well as iptable.
I do no how to trace the issue when its not working.

My Server eth0= 192.168.1.21(From Modem) eth1= 192.168.2.31(To LAN N/W)

Guide me,no problem if i need to change the IP's also.
Siva

No I ran it, but I don’t know how to check it out… Can u please give me the configurations for squid as well as iptable.
I do no how to trace the issue when its not working.

My Server eth0= 192.168.1.21(From Modem) eth1= 192.168.2.31(To LAN N/W)

Guide me,no problem if i need to change the IP’s also.
Anonymous

Hi Santy,
Actually i don't understand how your network structure.
Can you tell me more clear?
And yes, to run squid as transparent proxy you need to to edit rule in iptables. i provided that in my post.
Put that in rc.local so everytime your server boot it will automatically configured.
http://www.ivankristianto.com Ivan

Hi Santy,
Actually i don’t understand how your network structure.
Can you tell me more clear?
And yes, to run squid as transparent proxy you need to to edit rule in iptables. i provided that in my post.
Put that in rc.local so everytime your server boot it will automatically configured.
Anonymous

Hi Siva,
in the squid.conf please change
acl localnet src 192.168.1.0/24
To
acl localnet src 192.168.2.0/24

and in iptables config change to:
SQUID_SERVER="192.168.1.21"
# Interface connected to Internet
INTERNET="eth0"
# Interface connected to LAN
LAN_IN="eth1"
# Squid port
SQUID_PORT="8080"

Restart squid and run the script.
Please point all of your client computer gateway to 192.168.2.31

Cheers
http://www.ivankristianto.com Ivan

Hi Siva,
in the squid.conf please change
acl localnet src 192.168.1.0/24
To
acl localnet src 192.168.2.0/24

and in iptables config change to:
SQUID_SERVER=”192.168.1.21″
# Interface connected to Internet
INTERNET=”eth0″
# Interface connected to LAN
LAN_IN=”eth1″
# Squid port
SQUID_PORT=”8080″

Restart squid and run the script.
Please point all of your client computer gateway to 192.168.2.31

Cheers
Siva

Thanks a lot….!! I did as u said, now its working perfectly. [Cheers]

Ivan, Presently I don't have control over the client machines. (Like customer own PC) Can i achive this gateway setup through DHCP..? If yes, please guide in the DHCP configuration.

Thanks again..!!
Siva

Thanks a lot….!! I did as u said, now its working perfectly. [Cheers]

Ivan, Presently I don’t have control over the client machines. (Like customer own PC) Can i achive this gateway setup through DHCP..? If yes, please guide in the DHCP configuration.

Thanks again..!!
Anonymous

Yes, you should use DHCP instead. Later i will make an article how to install a DHCP server.
http://www.ivankristianto.com Ivan

Yes, you should use DHCP instead. Later i will make an article how to install a DHCP server.
Siva

Ivan, Please help me in this if you can. I have done with all even in reporting through SARG apps. Issue is, I could only view client host IP address in my report. Is there any possiblities to see the client host name instead of IP address in SARG report?

Like changing the Squid access.log format instead of IP address remote HOST NAME..!

Thanks in advance…!!
Siva

Ivan, Please help me in this if you can. I have done with all even in reporting through SARG apps. Issue is, I could only view client host IP address in my report. Is there any possiblities to see the client host name instead of IP address in SARG report?

Like changing the Squid access.log format instead of IP address remote HOST NAME..!

Thanks in advance…!!
Anonymous

I'm sorry Siva, i don't use SARG apps. So i don't know about it.
But i'm using my own report, by see continuous log from the squid. I publish the article on my blog at http://www.ivankristianto.com/2009/07/tips-show-squid-log-continuously-squid-web-proxy/
Hope you like it.
Thanks.
http://www.ivankristianto.com Ivan

I’m sorry Siva, i don’t use SARG apps. So i don’t know about it.
But i’m using my own report, by see continuous log from the squid. I publish the article on my blog at http://www.ivankristianto.com/2009/07/tips-show-squid-log-continuously-squid-web-proxy/
Hope you like it.
Thanks.
ashar

hi dear i m using centos 5.3 &2.6 squid i m using so can u help me for transparent squid i got yahoo problem with this so help me for proper work plz mail me on this id whois_thebest2001@yahoo.com
plz help
ashar

hi dear i m using centos 5.3 &2.6 squid i m using so can u help me for transparent squid i got yahoo problem with this so help me for proper work plz mail me on this id whois_thebest2001@yahoo.com
plz help
Anonymous

Hi Ashar,
What is the problem?
Please follow my guide step by step. It will work.
I'm using CentOS 5.1 with Squid 2.6. And it running for 2 years now.
Cheers.
http://www.ivankristianto.com Ivan

Hi Ashar,
What is the problem?
Please follow my guide step by step. It will work.
I’m using CentOS 5.1 with Squid 2.6. And it running for 2 years now.
Cheers.
Rbas

Is it possible to implement transparent proxy for https? I know it is not allowed because it will be a 'man-in-the-middle attack'. Any options to allow https accesses through transparent proxy? Any help will be appreciated.

Thanks a lot in advance.
-RB
Rbas

Is it possible to implement transparent proxy for https? I know it is not allowed because it will be a ‘man-in-the-middle attack’. Any options to allow https accesses through transparent proxy? Any help will be appreciated.

Thanks a lot in advance.
-RB
cembeliq

i save file in iptable.sh
Then i run :

root@cembeliq-laptop:/home/cembeliq/Documents# ./iptable.sh
1
./iptable.sh: 28: gt: not found
./iptable.sh: 28: /proc/sys/net/ipv4/ip_forward: Permission denied

Any solution for this?
cembeliq

i save file in iptable.sh
Then i run :

root@cembeliq-laptop:/home/cembeliq/Documents# ./iptable.sh
1
./iptable.sh: 28: gt: not found
./iptable.sh: 28: /proc/sys/net/ipv4/ip_forward: Permission denied

Any solution for this?
Anonymous

Hi cembelig,
Please change ">" to ">" without quotes.
and save.
it will run now.
Thanks
http://www.ivankristianto.com Ivan

Hi cembelig,
Please change “>” to “>” without quotes.
and save.
it will run now.
Thanks
cembeliq

yeah.. i finally got it

thank Mr. Ivan..
cembeliq

yeah.. i finally got it

thank Mr. Ivan..
andre

Mr. ivan i have 2 lines adsl and how to add the second line in your script? LAN is Eth0, modem 1 = Eth1,modem 2= Eth2 please send to my email. thx

best regards
andre

nseshop@gmail.com
andre

Mr. ivan i have 2 lines adsl and how to add the second line in your script? LAN is Eth0, modem 1 = Eth1,modem 2= Eth2 please send to my email. thx

best regards
andre

nseshop@gmail.com
Anonymous

Hi Andre,
why do you need 2 modem?
i don't know how to set the script to provide your architecture.
If anyone know that, please share it with us here.
thanks.
http://www.ivankristianto.com Ivan

Hi Andre,
why do you need 2 modem?
i don’t know how to set the script to provide your architecture.
If anyone know that, please share it with us here.
thanks.
atif

which path i save the iptables files and how to run this file
atif

which path i save the iptables files and how to run this file
Anonymous

you can save and run it frm /opt or /home/user folder.
give run permission with chmod +x to the file.
and you can run it by ./iptables.sh
Cheers.
http://www.ivankristianto.com Ivan

you can save and run it frm /opt or /home/user folder.
give run permission with chmod +x to the file.
and you can run it by ./iptables.sh
Cheers.
gelek

Thank you verymuch for this wonderful script !
I always have problem with iptables, but this script that's fine? THHX
gelek

Thank you verymuch for this wonderful script !
I always have problem with iptables, but this script that's fine? THHX
Anonymous

It's nice to hear i can help you out…
http://www.ivankristianto.com Ivan

It's nice to hear i can help you out…
YOGESH

Hi Everyone,

My Problem is little bit confusing.I m using redhat5.2 and set up transparent proxy.My problem is that i am not able to get http access, but suprisingly i can acess https://example.com:7071 etc even can access ftp server.
Can Anybody tell me the problem ?

Here is My Iptables command

# squid server IP
SQUID_SERVER="203.153.41.76"
# Interface connected to Internet
INTERNET="eth0"
# Interface connected to LAN
LAN_IN="eth1"
# Squid port
SQUID_PORT="8080"

# DO NOT MODIFY BELOW
# Clean old firewall
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
# Load IPTABLES modules for NAT and IP conntrack support
modprobe ip_conntrack
modprobe ip_conntrack_ftp
# For win xp ftp client
#modprobe ip_nat_ftp
echo 1 > /proc/sys/net/ipv4/ip_forward
# Setting default filter policy
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
# Unlimited access to loop back
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# Allow UDP, DNS and Passive FTP
iptables -A INPUT -i $INTERNET -m state –state ESTABLISHED,RELATED -j ACCEPT
# set this system as a router for Rest of LAN
iptables –table nat –append POSTROUTING –out-interface $INTERNET -j MASQUERADE
iptables –append FORWARD –in-interface $LAN_IN -j ACCEPT
# unlimited access to LAN
iptables -A INPUT -i $LAN_IN -j ACCEPT
iptables -A OUTPUT -o $LAN_IN -j ACCEPT
# DNAT port 80 request comming from LAN systems to squid 3128 ($SQUID_PORT) aka transparent proxy
iptables -t nat -A PREROUTING -i $LAN_IN -p tcp –dport 80 -j DNAT –to $SQUID_SERVER:$SQUID_PORT
# if it is same system
iptables -t nat -A PREROUTING -i $INTERNET -p tcp –dport 80 -j REDIRECT –to-port $SQUID_PORT
# DROP everything and Log it
iptables -A INPUT -j LOG
iptables -A INPUT -j DROP

and if I do lan sttings(browser sttings than i can access the http sites)

Thanks In Advance
Yogesh
yogesh2tech@gmail.com
YOGESH

Hi Everyone,

My Problem is little bit confusing.I m using redhat5.2 and set up transparent proxy.My problem is that i am not able to get http access, but suprisingly i can acess https://example.com:7071 etc even can access ftp server.
Can Anybody tell me the problem ?

Here is My Iptables command

# squid server IP
SQUID_SERVER="203.153.41.76"
# Interface connected to Internet
INTERNET="eth0"
# Interface connected to LAN
LAN_IN="eth1"
# Squid port
SQUID_PORT="8080"

# DO NOT MODIFY BELOW
# Clean old firewall
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
# Load IPTABLES modules for NAT and IP conntrack support
modprobe ip_conntrack
modprobe ip_conntrack_ftp
# For win xp ftp client
#modprobe ip_nat_ftp
echo 1 > /proc/sys/net/ipv4/ip_forward
# Setting default filter policy
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
# Unlimited access to loop back
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# Allow UDP, DNS and Passive FTP
iptables -A INPUT -i $INTERNET -m state –state ESTABLISHED,RELATED -j ACCEPT
# set this system as a router for Rest of LAN
iptables –table nat –append POSTROUTING –out-interface $INTERNET -j MASQUERADE
iptables –append FORWARD –in-interface $LAN_IN -j ACCEPT
# unlimited access to LAN
iptables -A INPUT -i $LAN_IN -j ACCEPT
iptables -A OUTPUT -o $LAN_IN -j ACCEPT
# DNAT port 80 request comming from LAN systems to squid 3128 ($SQUID_PORT) aka transparent proxy
iptables -t nat -A PREROUTING -i $LAN_IN -p tcp –dport 80 -j DNAT –to $SQUID_SERVER:$SQUID_PORT
# if it is same system
iptables -t nat -A PREROUTING -i $INTERNET -p tcp –dport 80 -j REDIRECT –to-port $SQUID_PORT
# DROP everything and Log it
iptables -A INPUT -j LOG
iptables -A INPUT -j DROP

and if I do lan sttings(browser sttings than i can access the http sites)

Thanks In Advance
Yogesh
yogesh2tech@gmail.com
Anonymous

Hi Yogesh,
Your iptables seems fine with me.
How about your squid config?
Please check your squid config around this code:

acl SSL_ports port 443 563
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT

http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports

http_port 8080 transparent
http://www.ivankristianto.com Ivan

Hi Yogesh,
Your iptables seems fine with me.
How about your squid config?
Please check your squid config around this code:

acl SSL_ports port 443 563
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT

http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports

http_port 8080 transparent
Yogesh

Hi Ivan
Thanks for a quick reply….

My squid version is squid-2.6.STABLE-5.el5 and Squid configuration is this

http_port 192.168.1.10:8080 transparent

acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
acl lan src 192.168.1.0/24

http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports

http_access allow localhost
http_access allow lan
http_access deny all

***************************
Thanks & Regards
Yogesh
Yogesh

Hi Ivan
Thanks for a quick reply….

My squid version is squid-2.6.STABLE-5.el5 and Squid configuration is this

http_port 192.168.1.10:8080 transparent

acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
acl lan src 192.168.1.0/24

http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports

http_access allow localhost
http_access allow lan
http_access deny all

***************************
Thanks & Regards
Yogesh
Anonymous

Hi Yogesh,
Your squid server ip is 203.153.41.76
but in your squid conf you made: http_port 192.168.1.10:8080 transparent
Please change it to:
http_port 8080 transparent
and change in your ipables script:
SQUID_SERVER="192.168.1.10"

Please let me know if it is works.
http://www.ivankristianto.com Ivan

Hi Yogesh,
Your squid server ip is 203.153.41.76
but in your squid conf you made: http_port 192.168.1.10:8080 transparent
Please change it to:
http_port 8080 transparent
and change in your ipables script:
SQUID_SERVER="192.168.1.10"

Please let me know if it is works.
Yogesh

Dear Ivan,

203.153.41.76 is the connected to Internet, and 192.168.1.10 is the local network IP.

Please forgive if i am wrong anywhere……
Yogesh

Dear Ivan,

203.153.41.76 is the connected to Internet, and 192.168.1.10 is the local network IP.

Please forgive if i am wrong anywhere……
Anonymous

Yes Yogesh,
you should bypass all Lan connection to squid port before connect to internet.
http://www.ivankristianto.com Ivan

Yes Yogesh,
you should bypass all Lan connection to squid port before connect to internet.
Yogesh

Thanks IVAN,

I got my problem solved…..

Thanks Again
Yogesh

Thanks IVAN,

I got my problem solved…..

Thanks Again
Anonymous

You are welcome Yogesh.
Glad to hear that
Good luck.
http://www.ivankristianto.com Ivan

You are welcome Yogesh.
Glad to hear that
Good luck.
long

Hi Ivan,

thanks for the helpful article.

i have apply all the setup for the transparent proxy,but suddenly my access.log is empty. i cannot track either my client browser is using the proxy or not. hope u can help me.
one more, i save the iptables.sh in the same folder with the squid.conf. it is ok?

thanks
long

Hi Ivan,

thanks for the helpful article.

i have apply all the setup for the transparent proxy,but suddenly my access.log is empty. i cannot track either my client browser is using the proxy or not. hope u can help me.
one more, i save the iptables.sh in the same folder with the squid.conf. it is ok?

thanks
Anonymous

hi long, yes you can save iptable.sh anywhere as long as you have execute permission.
Please check your network config, squid config and iptables config carefully.
And check if squid is running.
Thanks
http://www.ivankristianto.com Ivan

hi long, yes you can save iptable.sh anywhere as long as you have execute permission.
Please check your network config, squid config and iptables config carefully.
And check if squid is running.
Thanks
long

thanks for the fast respon.

i'm able to get back my access.log with the related info.
i want to ask u about iptables. i need to flush my iptables before my browser can surf internet. why? if not, i cannot surf the internet.

thanks
long

thanks for the fast respon.

i'm able to get back my access.log with the related info.
i want to ask u about iptables. i need to flush my iptables before my browser can surf internet. why? if not, i cannot surf the internet.

thanks
Anonymous

@long:
You need to run the iptables.sh on boot.
so it will automatically load when boot process.
http://www.ivankristianto.com Ivan

@long:
You need to run the iptables.sh on boot.
so it will automatically load when boot process.
long

Ivan,

how can i make it run on boot?
sorry.i'm a newbie to unix.

thanks
long

Ivan,

how can i make it run on boot?
sorry.i'm a newbie to unix.

thanks
Anonymous

@long,
Please refer to my blogpost
http://www.ivankristianto.com/os/ubuntu/howto-run-script-on-boot-process-in-ubuntu/1171/
http://www.ivankristianto.com Ivan

@long,
Please refer to my blogpost
http://www.ivankristianto.com/os/ubuntu/howto-run-script-on-boot-process-in-ubuntu/1171/
long

thanks ivan for your helpful article.
long

thanks ivan for your helpful article.
long

Hi Ivan,

i have a new problem now..suddenly i cannot stop my squid.
if my enter 'service squid restart' it will pop up
stopping squid:…………………………………..
starting squid: [failed]
long

Hi Ivan,

i have a new problem now..suddenly i cannot stop my squid.
if my enter 'service squid restart' it will pop up
stopping squid:…………………………………..
starting squid: [failed]
Anonymous

Please post your squid.log here.
I will try to help you.
http://www.ivankristianto.com Ivan

Please post your squid.log here.
I will try to help you.
long

Hi IVan,

sory for late reply. i'm able to solve my previous issue. right now, i faced new problem,
suddenly my setup for transparent proxy is not working. access.log not populated any more.prior this, i have configured my squid to transparent proxy and url_rewrite_program for URL redirection. my browser suppose to work in transparent and do a url redirection based to certain condition i created. please do advised me on how to fix this. thanks

my squid server is '202.45.139.161'
interface to internet is 'eth0'
interface to lan is '202.45.139.163'

my squid.conf setup is:

acl lan src 202.45.139.163/255.255.255.255

below is my setup for iptables:

SQUID_SERVER=”202.45.139.161″
# Interface connected to Internet
INTERNET=”eth0″
# Interface connected to LAN
LAN_IN=”202.45.139.163″
# Squid port
SQUID_PORT=”3128″

# DO NOT MODIFY BELOW
# Clean old firewall
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
# Load IPTABLES modules for NAT and IP conntrack support
modprobe ip_conntrack
modprobe ip_conntrack_ftp
# For win xp ftp client
#modprobe ip_nat_ftp
echo 1 > /proc/sys/net/ipv4/ip_forward
# Setting default filter policy
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
# Unlimited access to loop back
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# Allow UDP, DNS and Passive FTP
iptables -A INPUT -i $INTERNET -m state –state ESTABLISHED,RELATED -j ACCEPT
# set this system as a router for Rest of LAN
iptables –table nat –append POSTROUTING –out-interface $INTERNET -j MASQUERADE
iptables –append FORWARD –in-interface $LAN_IN -j ACCEPT
# unlimited access to LAN
iptables -A INPUT -i $LAN_IN -j ACCEPT
iptables -A OUTPUT -o $LAN_IN -j ACCEPT
# DNAT port 80 request comming from LAN systems to squid 3128 ($SQUID_PORT) aka transparent proxy
iptables -t nat -A PREROUTING -i $LAN_IN -p tcp –dport 80 -j DNAT –to $SQUID_SERVER:$SQUID_PORT
# if it is same system
iptables -t nat -A PREROUTING -i $INTERNET -p tcp –dport 80 -j REDIRECT –to-port $SQUID_PORT
# DROP everything and Log it
iptables -A INPUT -j LOG
iptables -A INPUT -j DROP
long

Hi Ivan. to add for below post.

before this problem happen. i can surf on transparent mode on mozilla firefox and google chrome but cannot with Internet Explorer.the only way is i need to set IE to use proxy,then it will populating in the access.log.. why is this happen? thanks
http://www.ivankristianto.com Ivan Kristianto

Hi long,
Have you check the iptables rule?
long

Hi Ivan,

i have check the iptables rule. i using eth0 instead of etho in the iptables..seem right now my setting for transparent proxy is not working. What other thing i need to check more?

thanks
long

hi,

after i execute iptables. below is the result when i type iptables -L
:
target prot opt source destination
ACCEPT all — anywhere anywhere
ACCEPT all — anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all — anywhere anywhere
LOG all — anywhere anywhere LOG level warning
DROP all — anywhere anywhere

Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all — anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all — anywhere anywhere
ACCEPT all — anywhere anywhere

is this the problem?

thanks
http://www.ivankristianto.com Ivan Kristianto

Hi long,
please describe your network topology.
Where is your client, router and modem. How the client connect to the internet.
And have you install DHCP and Bind server?
Add me to gmail chat if you want, and we can talk freely.
long

Hi Ivan,
my client is connected to a switch and go the server(squid).
my server(squid) is also connected to a same switch
from switch to a gateway and go to the internet.
i also have other local server that will be used for url_rewrite_program.
this local server have the same connection to the switch.
my server(squid) is running on centos.
i think my centos already equipped with DHCP and Bind. i will check further
tomorrow.

tomorrow i will add to gmail chat and we can talk more about this setup.

thanks,
long
Haiarun143

If i have only one NIC ( eth0 ) card is it possible to make a transparent proxy server .. if so what should changes should be done in this ? can you pls help me to configure ?
http://www.ivankristianto.com Ivan Kristianto

Haven't try it yet. But you can set port forwarding from port 80 to squid port.
long

Hi Ivan,

i have changed my network topology and my transparent proxy mode works.
i realized my mistakes when i read several times your article. i followed all the steps and finally i am able to surf with transparent proxy. thanks a lot for your guide.

long
http://www.ivankristianto.com Ivan Kristianto

It's nice to know that you are finally get it working.
I'm happy for you.
Btw can you tell us where did you go wrong? so if someday another reader come and read this article can learn from you.
long

thanks. my mistakes came from the setup of my system. before this, i'm not using eth1 as the interface to the client. the client is separately from the squid's server. i fix this problem by connect the client directly to the server eth1. i restart the squid and run the iptables and it works.
Yogesh2tech

Hello Ivan,
Hope you are doing well.

I am using squid Version 2.6.STABLE6 in transparent mode, My users use squid server ip 192.168.1.1 as their gateway to access internet. I have made various acl's and working well.
But now I want to disable gmail chat with gtalk messanger.although i have setup squid to block gmail chat in browser and it is also working but when user type https://gmail.com/ than it is not effective. and users are also using gtalk. Pls help me to disable gmail chat and gtalk.

Regards
Yogesh2tech@gmail.com
http://www.ivankristianto.com Ivan Kristianto

Hi Yogesh, i suggesst you to block gtalk port instead of block the domain.
To block Gtalk, you can set the restriction to this address:
Block access to 216.239.37.125, 72.14.253.125, 72.14.217.189 and 209.85.137.125 on ports 20, 21, 80, 443, 5222 and 5223.
Good luck!
Yogesh2tech

Hi Ivan,

Can you tell me what I need to do this to achieve ?

Pls keep in mind that we are also running our own mail server with instant messaging feature running on same port 5222

Regards
Yogesh
Live

Hello Ivan, nice article, is there any way you can teach me how to block torrent connections via Squid or Iptables? I’m using Ubuntu. Thanks.
Yogesh2tech

Hi Ivan ,

Pls suggest me how to block these ip for these particular ports because I have alredy tried lot more but still not able to block the gtalk.

Pls help me!

Thanks
Yogesh
http://www.ivankristianto.com Ivan Kristianto

To block torrent connection maybe a little tricky since it change overtime.
My suggestion is, block all the ports, except some important ports.
Qobcc

Ok, noob here, I cant get the script to execute? How do I run it?
Qobcc

Forgot to mention I get: bash: /etc/setup.iptables: /bin/sh^M: bad interpreter : No such file or directory
http://www.ivankristianto.com Ivan Kristianto

Did you run it with root permission or with sudo?
Qobcc

Hi, thank you for replying, you are a star in the dark expansive world of Linux. Yes I did used sudo (and sudo su) in terminal and tried running it trough webmin also, get the same error. I am using Ubuntu 10.04 LTS. Double checked on on your response to make sure, still get same error: bad interpreter: no such file or dierctoy.
http://www.ivankristianto.com Ivan Kristianto

Please try to run iptables -L or iptables -h
is the output show or error message?
Qobcc

Hi, doing it manually, get a problem on the echo line… [1] 2745 1 gt: command not found [1]+ done echo1 bash /proc/sys/net/ipv4/ip_foward: Permission denied (Did sudo)
Qobcc

I did google and tried this gksudo gedit /etc/sysctl.conf
# Uncomment the next line to enable packet forwarding for IPv4
net.ipv4.conf.default.forwarding=1

but the line in my file looks different:
net.ipv4.ip_foward=1

will it be ok to do it this way?
http://www.ivankristianto.com Ivan Kristianto

Yes ip forwarding should be on. but in your case it should be on by default.
Qobcc

I’m really making an effort on this side for this to work, so sorry for bugging you. What I find now is that squid ‘works’. When I type an ip in the browser on my workstations (say for google) it opens the web page. But if I use http://www.xxxxx.com it doesnt. If I do it with the ip it shows up in my squid tail log, if I type the web address it doenst work and nothing happens on the log in my server. What am I missing?
http://www.ivankristianto.com Ivan Kristianto

Have you install Bind9 as your dns server?
install Bind9 and forward all request to your dns server that you got from your provider.
Qobcc

You are a genuis! Bind9 did the trick. It is not packaged with Ubuntu 10 LTS desktop. Thank you!!
http://www.ivankristianto.com Ivan Kristianto

Glad to know that i can help you.
Thanks

blog comments powered by Disqus

About Author

Ivan Kristianto is a freelancer web developer and blogger. He started to blog since November 2007. He start this site since April 2008. With bachelor of Engineering degree background he writes articles in IT related field and share through this blog. [More...]
- RSS Updates
- Twitter
- Facebook
- LinkedIn
Sign up for our daily email newsletter
Popular Posts
Popular Articles
Recent Articles
Recent Articles
Popular Search Terms
Popular Search Articles

Internet explorer for iPad, ubuntu media player, resident evil afterlife megavideo, blackberry 9700 os 6 download, net_rim_bb_universalsearch_lib, Facebook needs the CURL PHP extension, mysql replace, Password (Resident Evil - Afterlife 2010) txt, resident evil afterlife megaupload, blackberry cracked apps, facebook hack attack download, firefox 4 deb, resident evil afterlife download, wordpress blank page, cracked blackberry apps, internet explorer for ipad download, wp-includes/pluggable php on line 890, ubuntu sound not working, hirens boot cd 11 download, ubuntu ftp server, ubuntu logo, ie for ipad, vuze ipad, blackberry apps rapidshare, resident evil afterlife download rapidshare, failed to start mobile internet, 9700 os 6 download, asp net linux, ipad internet explorer, blackberry os 6 9700 download, sqlite c#, ubuntu logo, VUZE for ipad, ubuntu how to install latest intel driver, teamviewer for blackberry, ubuntu sound problem, things to do after installing ubuntu 10 04, resident evil afterlife rapidshare, internet explorer on ipad, os 6 9700 download, teamviewer android, teamviewer blackberry, asp net on linux, internet explorer ipad, install curl, ie on ipad, change gw ubuntu, mysql replace string, facebook hack attack free download, blackberry bold 9700 os 6 download,
Community News
Submit + More »
- 70 Design News Websites To Submit Your Content AtAugust 27, 2010
  Collection of 70 Web and Graphic Design News Websites To Submit Your Content At and promote your Blog For Free
- Bokeh Effect in Photoshop with any background colo…August 26, 2010
  Bokeh effects are pleasing to eyes and they are effective in any design works. Whether they are wallpaper or website backgrounds or powerpoint presentation backgrounds they work effectively and emp…
- Install Opera Mobile in Ubuntu (.deb)August 9, 2010
  A few days back we covered how to run Opera Mini – the super tiny mobile web browser from Opera – in Ubuntu. Today we're looking at installing and using Opera Mobile – the l…
- Ubuntu 10.10 To Ship With Firefox 3.6August 7, 2010
  Ubuntu 10.10 Maverick Meerkat will ship with Firefox 3.6. That's not because there's something wrong with Firefox 4.0, but because the first Firefox 4.0 release candidate is scheduled for…
- Firefox 4 Beta 2 is here – Welcome CSS3 transiti…August 1, 2010
  The two major features for web developers with this release are Performance improvements and CSS3 Transitions on CSS3 Transforms.

Ivan Kristianto Blog

[HowTo] Install and Configure Squid as Transparent Proxy

What people search:

Article by Ivan Kristianto

About Author

Popular Articles

Recent Articles

Popular Search Articles

Community News

Categories

Archives

TagClouds

Ivan Kristianto Blog

[HowTo] Install and Configure Squid as Transparent Proxy

What people search:

Article by Ivan Kristianto

About Author

Popular Articles

Recent Articles

Popular Search Articles

Community News

Categories

Archives

TagClouds

Blogroll