Re: [squid-users] Local Squid

Hello,
i think if you set:
 iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT --to-port 3128
each output request (included squid requests) are nated to local 3128
port.

-- 
Best regards,
Loïc BLOT, 
UNIX systems, security and network engineer
http://www.unix-experience.fr
Le dimanche 22 septembre 2013 à 08:58 -0400, shawn wilson a écrit :
> I'm trying to setup a transparent proxy on my local machine. This
> works when I give Firefox proxy info, but this fails when I get
> iptables to redirect with (the rule I keep turning on/off):
> iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT --to-port 3128
> 
> And the rest of the nat table is just:
> *nat
> -A OUTPUT -m owner --uid-owner 31 -j ACCEPT
> COMMIT
> 
> When this is enabled, I just get:
> ERROR
> 
> The requested URL could not be retrieved
> 
> and "Invalid URL"
> Which is a squid message and I'm seeing the requests in the access log
> but I'm guessing something needs to be rewritten that isn't or squid
> is doing too much.
> 
> swlap1 ~ # squid -v
> Squid Cache: Version 3.3.8
> configure options:  '--prefix=/usr' '--build=x86_64-pc-linux-gnu'
> '--host=x86_64-pc-linux-gnu' '--mandir=/usr/share/man'
> '--infodir=/usr/share/info' '--datadir=/usr/share' '--sysconfdir=/etc'
> '--localstatedir=/var/lib' '--libdir=/usr/lib64'
> '--disable-dependency-tracking' '--sysconfdir=/etc/squid'
> '--libexecdir=/usr/libexec/squid' '--localstatedir=/var'
> '--with-pidfile=/run/squid.pid' '--datadir=/usr/share/squid'
> '--with-logdir=/var/log/squid' '--with-default-user=squid'
> '--enable-removal-policies=lru,heap'
> '--enable-storeio=aufs,diskd,rock,ufs' '--enable-disk-io'
> '--enable-auth'
> '--enable-auth-basic=MSNT,MSNT-multi-domain,NCSA,POP3,getpwnam,PAM'
> '--enable-auth-digest=file' '--enable-auth-ntlm=none'
> '--enable-auth-negotiate=none'
> '--enable-external-acl-helpers=file_userip,session,unix_group'
> '--enable-log-daemon-helpers' '--enable-url-rewrite-helpers'
> '--enable-cache-digests' '--enable-delay-pools' '--enable-eui'
> '--enable-icmp' '--enable-follow-x-forwarded-for' '--enable-esi'
> '--with-large-files' '--disable-strict-error-checking'
> '--without-libcap' '--enable-ipv6' '--disable-snmp' '--enable-ssl'
> '--disable-ssl-crtd' '--disable-icap-client' '--disable-ecap'
> '--enable-linux-netfilter' 'build_alias=x86_64-pc-linux-gnu'
> 'host_alias=x86_64-pc-linux-gnu' 'CC=x86_64-pc-linux-gnu-gcc'
> 'CFLAGS=-march=native -freorder-blocks-and-partition -O2 -pipe'
> 'LDFLAGS=-Wl,-O1 -Wl,--as-needed' 'CXXFLAGS=-march=native
> -freorder-blocks-and-partition -O2 -pipe'
> 'PKG_CONFIG_PATH=/usr/lib64/pkgconfig'
> 
> /etc/squid/squid.conf:
> 
> #
> # Recommended minimum configuration:
> #
> 
> # Example rule allowing access from your local networks.
> # Adapt to list your (internal) IP networks from where browsing
> # should be allowed
> acl localnet src 10.0.0.0/8    # RFC1918 possible internal network
> acl localnet src 172.16.0.0/12    # RFC1918 possible internal network
> acl localnet src 192.168.0.0/16    # RFC1918 possible internal network
> acl localnet src fc00::/7       # RFC 4193 local private network range
> acl localnet src fe80::/10      # RFC 4291 link-local (directly
> plugged) machines
> 
> acl SSL_ports port 443
> acl Safe_ports port 80        # http
> acl Safe_ports port 21        # ftp
> acl Safe_ports port 443        # https
> acl Safe_ports port 70        # gopher
> acl Safe_ports port 210        # wais
> acl Safe_ports port 1025-65535    # unregistered ports
> acl Safe_ports port 280        # http-mgmt
> acl Safe_ports port 488        # gss-http
> acl Safe_ports port 591        # filemaker
> acl Safe_ports port 777        # multiling http
> acl Safe_ports port 901        # SWAT
> acl CONNECT method CONNECT
> 
> #
> # Recommended minimum Access Permission configuration:
> #
> # Deny requests to certain unsafe ports
> http_access deny !Safe_ports
> 
> # Deny CONNECT to other than secure SSL ports
> http_access deny CONNECT !SSL_ports
> 
> # Only allow cachemgr access from localhost
> http_access allow localhost manager
> http_access deny manager
> 
> # We strongly recommend the following be uncommented to protect innocent
> # web applications running on the proxy server who think the only
> # one who can access services on "localhost" is a local user
> #http_access deny to_localhost
> 
> #
> # INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
> #
> acl localhost src 127.0.0.1/32 ::1
> acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
> 
> 
> # Example rule allowing access from your local networks.
> # Adapt localnet in the ACL section to list your (internal) IP networks
> # from where browsing should be allowed
> http_access allow localnet
> http_access allow localhost
> 
> # And finally deny all other access to this proxy
> http_access deny all
> 
> # Squid normally listens to port 3128
> http_port 3128 transparent
> 
> # Uncomment and adjust the following to add a disk cache directory.
> #cache_dir ufs /var/cache/squid 100 16 256
> 
> # Leave coredumps in the first cache dir
> coredump_dir /var/cache/squid
> 
> #
> # Add any of your own refresh_pattern entries above these.
> #
> refresh_pattern ^ftp:        1440    20%    10080
> refresh_pattern ^gopher:    1440    0%    1440
> refresh_pattern -i (/cgi-bin/|\?) 0    0%    0
> refresh_pattern .        0    20%    4320