Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
Squid running on two ports, transparent and normal
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
-Craig-
Guru
Guru


Joined: 03 Jun 2004
Posts: 333

PostPosted: Tue Feb 07, 2006 5:39 pm    Post subject: Squid running on two ports, transparent and normal Reply with quote

Hello!
Is it possible to run Squid on two ports at a time, one as transparent Proxy and one as a normal Proxy?

Code:

                 LAN2
                  /
                 /
Internet----Firewall-----LAN1



LAN 1 is configured to use the Firewall as normal Proxy
LAN 2 is NAT'ed directly through to the internet

I want to keep the config for LAN1, but LAN2 should use a transparent Proxy which runs on the Firewall. Iptables configuration and so on is is not a problem, but I need to know if that setup is possible with a single squid configuration.
Back to top
View user's profile Send private message
snis
Tux's lil' helper
Tux's lil' helper


Joined: 03 Mar 2003
Posts: 93
Location: Stockholm, Sweden

PostPosted: Wed Feb 08, 2006 9:02 pm    Post subject: Reply with quote

Hi,

Why do you need it to run on two ports?

In transparent mode you have an iptables rule that says something like this:
Code:
# iptables -t nat -A PREROUTING -i LAN1 -p tcp --dport 80 -j REDIRECT --to-port 3128

On LAN2 you only have to tell your browse to use the proxy at Firewall.LAN2.ip:3128

And don't forgett to allow the clients to access port 3128 on LAN2
Back to top
View user's profile Send private message
-Craig-
Guru
Guru


Joined: 03 Jun 2004
Posts: 333

PostPosted: Thu Feb 09, 2006 5:30 pm    Post subject: Reply with quote

So transparent mode can also handle "normal" proxy requests? That would be better even!
Back to top
View user's profile Send private message
snis
Tux's lil' helper
Tux's lil' helper


Joined: 03 Mar 2003
Posts: 93
Location: Stockholm, Sweden

PostPosted: Sat Feb 11, 2006 10:10 pm    Post subject: Reply with quote

Yes it can, the so called transparent mode is only a way to force all http request to go through squid. This is done by redirecting all the http request on port 80 to port 3128 (squid default).
The same goes for content filtering, if you want to run for example danguardian you forward all requests to port 8080 (dansguardian default) and then you tell dansguardian to direct all it's requests to port 3128 if you wan tsquid to proxy the requests at the same time.
You should however be aware that not all http traffic is forwarded to the squid proccess, only packets on port 80 (from my example in the eariler post). I haven't digged any deeper into this, so I'm in no way an expert on this subject. I you however put a proxy in your broswer settings then all http traffic will go through the squid proxy.
An example: there is a site called *.istheshit.net (msfirewall.istheshit.net | linux.istheshit.net) they have a picture for all the sites, and the picture is requested from the server at port 8000.
Perhaps someone more familiar with iptables and squid could help out here.
Back to top
View user's profile Send private message
jamapii
l33t
l33t


Joined: 16 Sep 2004
Posts: 637

PostPosted: Sun Feb 12, 2006 11:29 am    Post subject: Reply with quote

I run squid on multiple ports, to provide unfiltered, adzapped, compressed, and "from-extern" (redirect to an external proxy) access. The iptables "transparent-proxy" feature just uses one of these ports.
Back to top
View user's profile Send private message
-Craig-
Guru
Guru


Joined: 03 Jun 2004
Posts: 333

PostPosted: Wed Feb 15, 2006 9:31 am    Post subject: Reply with quote

Well, outgoing connections to other ports than 80 are forbidden for those clients, so it's ok.
@jamapii; your config would be interesting, could you paste it here?

Thanks for your help! :)
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum