View previous topic :: View next topic |
Author |
Message |
-Craig- Guru
Joined: 03 Jun 2004 Posts: 333
|
Posted: Tue Feb 07, 2006 5:39 pm Post subject: Squid running on two ports, transparent and normal |
|
|
Hello!
Is it possible to run Squid on two ports at a time, one as transparent Proxy and one as a normal Proxy?
Code: |
LAN2
/
/
Internet----Firewall-----LAN1
|
LAN 1 is configured to use the Firewall as normal Proxy
LAN 2 is NAT'ed directly through to the internet
I want to keep the config for LAN1, but LAN2 should use a transparent Proxy which runs on the Firewall. Iptables configuration and so on is is not a problem, but I need to know if that setup is possible with a single squid configuration. |
|
Back to top |
|
|
snis Tux's lil' helper
Joined: 03 Mar 2003 Posts: 93 Location: Stockholm, Sweden
|
Posted: Wed Feb 08, 2006 9:02 pm Post subject: |
|
|
Hi,
Why do you need it to run on two ports?
In transparent mode you have an iptables rule that says something like this:
Code: | # iptables -t nat -A PREROUTING -i LAN1 -p tcp --dport 80 -j REDIRECT --to-port 3128 |
On LAN2 you only have to tell your browse to use the proxy at Firewall.LAN2.ip:3128
And don't forgett to allow the clients to access port 3128 on LAN2 |
|
Back to top |
|
|
-Craig- Guru
Joined: 03 Jun 2004 Posts: 333
|
Posted: Thu Feb 09, 2006 5:30 pm Post subject: |
|
|
So transparent mode can also handle "normal" proxy requests? That would be better even! |
|
Back to top |
|
|
snis Tux's lil' helper
Joined: 03 Mar 2003 Posts: 93 Location: Stockholm, Sweden
|
Posted: Sat Feb 11, 2006 10:10 pm Post subject: |
|
|
Yes it can, the so called transparent mode is only a way to force all http request to go through squid. This is done by redirecting all the http request on port 80 to port 3128 (squid default).
The same goes for content filtering, if you want to run for example danguardian you forward all requests to port 8080 (dansguardian default) and then you tell dansguardian to direct all it's requests to port 3128 if you wan tsquid to proxy the requests at the same time.
You should however be aware that not all http traffic is forwarded to the squid proccess, only packets on port 80 (from my example in the eariler post). I haven't digged any deeper into this, so I'm in no way an expert on this subject. I you however put a proxy in your broswer settings then all http traffic will go through the squid proxy.
An example: there is a site called *.istheshit.net (msfirewall.istheshit.net | linux.istheshit.net) they have a picture for all the sites, and the picture is requested from the server at port 8000.
Perhaps someone more familiar with iptables and squid could help out here. |
|
Back to top |
|
|
jamapii l33t
Joined: 16 Sep 2004 Posts: 637
|
Posted: Sun Feb 12, 2006 11:29 am Post subject: |
|
|
I run squid on multiple ports, to provide unfiltered, adzapped, compressed, and "from-extern" (redirect to an external proxy) access. The iptables "transparent-proxy" feature just uses one of these ports. |
|
Back to top |
|
|
-Craig- Guru
Joined: 03 Jun 2004 Posts: 333
|
Posted: Wed Feb 15, 2006 9:31 am Post subject: |
|
|
Well, outgoing connections to other ports than 80 are forbidden for those clients, so it's ok.
@jamapii; your config would be interesting, could you paste it here?
Thanks for your help! |
|
Back to top |
|
|
|