🚀 go-pugleaf

We didn't have to change our firewall rules..   as long as you can get
out on the masq you should be ok..   far as setting up squid, you can
pretty much install the RPMS and goto the squid.conf file and go through
it.  The .conf explains itself pretty well.  If you want to run  it as a
transparent proxy... you simply use prerouting to grab all packets on 80
and send them to 3128 on squid... ;)

Once we've got everyone swapped over to squid, we may make some
additional changes to the  masquerading on the appropriate subnets... :)  


In article <9acjfg$80u$1@perki.connect.com.au>, "Theng Ung"
<tung@connect.com.au> wrote:

> Hi,
> 
> I  had a Linux Red Hat 7.0, connect via Cable modem(with Telstra) on
> ethernet adapter 0 and using firestarter as firewall. At the moment I
> had set up the box as a gateway for my other PC which connect via a
> second ethernet adapter 1.
> 
> I would like to get some help with a  basic Squid configuration that I
> can use to setup my linux gateway as proxy server for my other PC. if I
> decide to user Squid as a proxy server do I need to make any adjustment
> in firewall rule?
> 
> 
> Regards,
> 
> Theng
> 
>

"maher" <maher@mimos.my> wrote in message news:3ACA8FB2.ADA69A68@mimos.my...
> KW wrote:
> >
> > We didn't have to change our firewall rules..   as long as you can get
> > out on the masq you should be ok..   far as setting up squid, you can
> > pretty much install the RPMS and goto the squid.conf file and go through
> > it.  The .conf explains itself pretty well.  If you want to run  it as a
> > transparent proxy... you simply use prerouting to grab all packets on 80
> > and send them to 3128 on squid... ;)
>
> BTW, how do you do that? is it using ipchains to redirect packets from
> 80 to 3128?

Prerouting ... sounds like iptables to me.  Anyway... below is a setup for
ipchains.

eg. you have 2 network card on the computer and you already have packet
forwarding enabled and set up via ipchains.

Internet<---->(203.x.x.x (dynamic))Server With Squid (192.168.1.1)<---->Your
Local LAN (192.168.1.x)

# A few things needed for transparent proxying
ipchains -A input -p tcp -d localhost 80 -j REJECT
ipchains -A input -d 192.168.1.1/32 80 -p tcp -j REJECT
ipchains -A input -d 192.168.1.1/32 80 -p udp -j REJECT

# Redirect things to port 80 to port 3128
ipchains -A input -s 192.168.1.0/24 -d 0.0.0.0/0 80 -p tcp -j REDIRECT 3128
ipchains -A input -s 192.168.1.0/24 -d 0.0.0.0/0 80 -p udp -j REDIRECT 3128

# Optionally, you can also redirect SSL and FTP
ipchains -A input -s 192.168.1.0/24 -d 0.0.0.0/0 443 -p tcp -j REDIRECT 3128
ipchains -A input -s 192.168.1.0/24 -d 0.0.0.0/0 443 -p udp -j REDIRECT 3128
ipchains -A input -s 192.168.1.0/24 -d 0.0.0.0/0 21 -p tcp -j REDIRECT 3128
ipchains -A input -s 192.168.1.0/24 -d 0.0.0.0/0 21 -p udp -j REDIRECT 3128

Your squid needs to be configured as a HTTPD accelerator as well.

httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_uses_host_header on

=-
Elem103

KW wrote:
> 
> We didn't have to change our firewall rules..   as long as you can get
> out on the masq you should be ok..   far as setting up squid, you can
> pretty much install the RPMS and goto the squid.conf file and go through
> it.  The .conf explains itself pretty well.  If you want to run  it as a
> transparent proxy... you simply use prerouting to grab all packets on 80
> and send them to 3128 on squid... ;)

BTW, how do you do that? is it using ipchains to redirect packets from
80 to 3128?
 
thanks

On Wed, 04 Apr 2001 08:06:26 +0500, maher <maher@mimos.my> wrote:

>> If you want to run  it as a
>> transparent proxy... you simply use prerouting to grab all packets on 80
>> and send them to 3128 on squid... ;)
>
>BTW, how do you do that? is it using ipchains to redirect packets from
>80 to 3128?

Isn't it easier to just tell squid to listen on port 80 as well?

/etc/squid/squid.conf
http_port 3128 80

-Chris

>>> If you want to run  it as a
>>> transparent proxy... you simply use prerouting to grab all packets on 80
>>> and send them to 3128 on squid... ;)
>>
>>BTW, how do you do that? is it using ipchains to redirect packets from
>>80 to 3128?
>
>Isn't it easier to just tell squid to listen on port 80 as well?

Not transparent, lusers would have to update settings. Chains syntax would be
something like:

    ipchains -A input -i <interface> -p tcp \
        -d 0.0.0.0/0 80 -j REDIRECT 3128

You might like to have a look at the following:
    
    http://rpmfind.net/linux/mdw/HOWTO/mini/TransparentProxy.html#toc5

-- adm

"Chris King" <ChrisKing@start.com.au> wrote in message
news:au4lctsqjdpvji52kuk6f7jsanqrdcrk55@4ax.com...
> On Wed, 04 Apr 2001 08:06:26 +0500, maher <maher@mimos.my> wrote:
>
> >> If you want to run  it as a
> >> transparent proxy... you simply use prerouting to grab all packets on
80
> >> and send them to 3128 on squid... ;)
> >
> >BTW, how do you do that? is it using ipchains to redirect packets from
> >80 to 3128?
>
> Isn't it easier to just tell squid to listen on port 80 as well?
>
> /etc/squid/squid.conf
> http_port 3128 80
>
> -Chris
>

Err.. no.  Listening on port 80 is not the way to go.  You have a traffic
going from say, your computer in your local LAN to a web server NOT from
your computer in your local LAN to your squid computer.  In another word,
your computer is not talking to the squid computer directly.

eg.

www.google.com <---> Your SQUID COMP <---> Your Computer

If squid listens on port 80, it is not transparent.  You have to configure
"Your Computer" to use the proxy at your squid computer at port 80.

Tranparent proxies are used by most ISPs to reduce the download bandwidth
when users do not automatically select a proxy.

=-
Elem103

On 4 Apr 2001 03:41:39 GMT, adam@foo.sweet.as (Adam Moore) wrote:

>>>> If you want to run  it as a
>>>> transparent proxy... you simply use prerouting to grab all packets on 80
>>>> and send them to 3128 on squid... ;)
>>>
>>>BTW, how do you do that? is it using ipchains to redirect packets from
>>>80 to 3128?
>>
>>Isn't it easier to just tell squid to listen on port 80 as well?
>
>Not transparent

Thanks for pointing that out. I'm not sure which bit of 'transparent'
I didn't understand in the original post. :-|

-Chris

Hi,

I manage to get it to work now. by using ipchains rules below (modify to suit
my LAN) and also reading this site
http://rpmfind.net/linux/mdw/HOWTO/mini/TransparentProxy-4.html . Elem103
mention most of it but the site mention something that I don't know before.
like
1. squid -z # run first time
2. http_access allow all  #in httpd.conf

Regarding the ipchains rules belows I simply just run it on top of the rules
generated by the firewall (firestarter).

Right now anyone can browse from my LAN (192.168.0.0/24)either using the proxy
or without the proxy that I set up.
I want to restrict everyone in my LAN to user the proxy server (192.168.0.3).
Any help is much appreciated.

Anway many thanks to Elem103 for his kind contributions.


Regads,

Theng


Elem103 wrote:

> "
>
> Prerouting ... sounds like iptables to me.  Anyway... below is a setup for
> ipchains.
>
> eg. you have 2 network card on the computer and you already have packet
> forwarding enabled and set up via ipchains.
>
> Internet<---->(203.x.x.x (dynamic))Server With Squid (192.168.1.1)<---->Your
> Local LAN (192.168.1.x)
>
> # A few things needed for transparent proxying
> ipchains -A input -p tcp -d localhost 80 -j REJECT
> ipchains -A input -d 192.168.1.1/32 80 -p tcp -j REJECT
> ipchains -A input -d 192.168.1.1/32 80 -p udp -j REJECT
>
> # Redirect things to port 80 to port 3128
> ipchains -A input -s 192.168.1.0/24 -d 0.0.0.0/0 80 -p tcp -j REDIRECT 3128
> ipchains -A input -s 192.168.1.0/24 -d 0.0.0.0/0 80 -p udp -j REDIRECT 3128
>
> # Optionally, you can also redirect SSL and FTP
> ipchains -A input -s 192.168.1.0/24 -d 0.0.0.0/0 443 -p tcp -j REDIRECT 3128
> ipchains -A input -s 192.168.1.0/24 -d 0.0.0.0/0 443 -p udp -j REDIRECT 3128
> ipchains -A input -s 192.168.1.0/24 -d 0.0.0.0/0 21 -p tcp -j REDIRECT 3128
> ipchains -A input -s 192.168.1.0/24 -d 0.0.0.0/0 21 -p udp -j REDIRECT 3128
>
> Your squid needs to be configured as a HTTPD accelerator as well.
>
> httpd_accel_host virtual
> httpd_accel_port 80
> httpd_accel_with_proxy on
> httpd_accel_uses_host_header on
>
> =-
> Elem103

"Theng Ung" <pung1@bigpond.net.au> wrote in message news:3AD1F8E7.5A9CF70F@bigpond.net.au...
> Hi,
> 
> I manage to get it to work now. by using ipchains rules below (modify to suit
> my LAN) and also reading this site
> http://rpmfind.net/linux/mdw/HOWTO/mini/TransparentProxy-4.html . Elem103
> mention most of it but the site mention something that I don't know before.
> like
> 1. squid -z # run first time
> 2. http_access allow all  #in httpd.conf

I think you meant squid.conf, but anyway, be careful with that directive.  That means that everyone can use your proxy especially if you bind it to every interface (ie including the one to the internet).  If they find out that you have a proxy, they might decide to use it, just to annoy you :)

A better way would be to use ACL:

eg.
acl mylocallan src 192.168.88.1-192.168.88.254/255.255.255.255
http_access allow mylocallan
http_access_deny all

Another way would be just to bind squid on your local LAN interface only.

http_port 192.168.88.1:3128

> Regarding the ipchains rules belows I simply just run it on top of the rules
> generated by the firewall (firestarter).

> Right now anyone can browse from my LAN (192.168.0.0/24)either using the proxy
> or without the proxy that I set up.
> I want to restrict everyone in my LAN to user the proxy server (192.168.0.3).
> Any help is much appreciated.
> 
> Anway many thanks to Elem103 for his kind contributions.

Welcome.

Cheers,
Elem103