Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Redirect web traffic to Squid on internal LAN

    Scheduled Pinned Locked Moved Firewalling
    13 Posts 2 Posters 15.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N
      NovceGuru
      last edited by

      Hello

      After searching for a while it seems this topic has been beat to death, but I can't seem to get anything working. I have a very basic setup,

      WAN IP (static)–--->pfSense(NAT/Firewalling)--->192.168.5.0/24 LAN

      I have a Squid proxy running on the internal LAN @ 192.168.5.10, I need to be able to redirect traffic while keeping the source IP of the request. (So that rules out creating an "outbound" NAT situation) I have tried following http://forum.pfsense.org/index.php/topic,4225.msg25915.html#msg25915 to the T, I've started from a fresh installation (1.01 stable) and followed it at least 5 times to make sure I did not miss anything. If I get this working I promise I will make a very detailed wiki entry on the matter :) Thanks.

      NovceGuru

      1 Reply Last reply Reply Quote 0
      • D
        dwadson
        last edited by

        In my config.xml, here's how my Squid "pool" is setup:

        <lbpool><type>gateway</type>
                                <behaviour>failover</behaviour>
                                <monitorip><name>squid</name>
                                <desc>Squid Transparent Proxy</desc>
                                <port><servers>192.168.0.12|192.168.0.12</servers></port></monitorip></lbpool>

        My LAN firewall rule to redirect traffic is:
        Proto      Source    Port    Destination    Port        Gateway
        TCP      !squid   *             *   80 (HTTP) squid

        You'll also need a rule on your Squid box to redirect the port 80 requests to the Squid port (probably 3128)

        1 Reply Last reply Reply Quote 0
        • N
          NovceGuru
          last edited by

          Thanks for the reply. Technically could I run the squid to listen on port 80? I do not have a firewall on the internal box. Thanks again.

          NovceGuru

          1 Reply Last reply Reply Quote 0
          • D
            dwadson
            last edited by

            You don't necessarily need a whole firewall running on your Squid box. Mine, running on CentOS, has a single iptables rule:

            iptables -t nat -A PREROUTING -i eth0 -d ! 192.168.0.12 -p tcp –dport 80 -j REDIRECT --to-ports 8080

            There's some sort of reason as to why the transparent proxy runs on a different port that I'll admit I'm not 100% sure on. It might simply be so that it doesn't conflict with a webserver running on the squid box.

            But first thing that you need to get working right is to have the port 80 traffic getting redirected out your Squid "gateway" on the pfSense box.

            1 Reply Last reply Reply Quote 0
            • N
              NovceGuru
              last edited by

              Thanks again for the reply.

              My squid box is running FreeBSD without a firewall, It's to bad I can't do that redirecting from the pfSense box. I think if that's not possible (which I assume it is not) I can just alias a free LAN address and run squid on port 80 on that box. I'll report back with what I find. Unfortunately I can't test this at the moment with people at the location of the box.

              NovceGuru

              1 Reply Last reply Reply Quote 0
              • N
                NovceGuru
                last edited by

                I have these settings:

                but the requests for some reason do not make it to 192.168.165.10, when I run tcpdump and make a request, my web client times out, but the logs show it allowing to connect. Thanks.

                NovceGuru

                1 Reply Last reply Reply Quote 0
                • D
                  dwadson
                  last edited by

                  The only significant difference I can see between your pfSense and mine is that I'm running one of the latest snapshots - 1.2-BETA-1-TESTING-SNAPSHOT-05-29-2007.

                  However, i thought I had this working on 1.0.1 before. Maybe not though.

                  It does appear that your packets are going through the firewall as mine are so you should probably turn your attention now to the Squid box to confirm that it's receiving the packets. It might simply be having Apache with MySAR running on it that makes me run my Squid on a different port.

                  1 Reply Last reply Reply Quote 0
                  • N
                    NovceGuru
                    last edited by

                    I might try the latest 1.2 beta. I aliased an ip address and bound squid to it, and setup apache to bind to the other address. I can access squid via my browser @ 192.168.165.12 (and reconfigured the pool and firewall rule to reflect these changes) and the packets never seem to hit the squid box.  :'( :'(

                    1 Reply Last reply Reply Quote 0
                    • N
                      NovceGuru
                      last edited by

                      Sadly still a no go on 1.2-BETA-1, I had to hand edit the xml file to make it reflect yours.

                      <servers>192.168.0.12|192.168.0.12</servers> was WAN:192.168.165.12 (that didn't work either)

                      back to the drawing board…

                      NovceGuru

                      1 Reply Last reply Reply Quote 0
                      • N
                        NovceGuru
                        last edited by

                        Mucking around via SSH I added

                        rdr on sis0 proto tcp from ! <letpastsquid>to any port 80 -> 192.168.165.12 port 3128</letpastsquid>

                        to rules.debug, and pfctl -f rules.debug and atleast got the packets to reach the squid box, but it basically does the same thing as before–> times out

                        1 Reply Last reply Reply Quote 0
                        • N
                          NovceGuru
                          last edited by

                          May I see your squid.conf? Although I am using it right now with it configured in the browser, and I think the only "special" thing I need is http_port 192.168.165.10:3128 transparent

                          Thanks,

                          NovceGuru

                          1 Reply Last reply Reply Quote 0
                          • N
                            NovceGuru
                            last edited by 

                            #this is the firewall, it has:

table <letpastsquid>{ 192.168.165.10 192.168.165.12 }
rdr on sis0 proto tcp from ! <letpastsquid>to any port 80 -> 192.168.165.12 port 3128
in pf.conf

pfsense:/tmp#  tcpdump -vv | grep -v ssh | grep -v NETBIOS | grep -v arp
tcpdump: listening on sis0, link-type EN10MB (Ethernet), capture size 96 bytes
18:34:31.172636 IP (tos 0x0, ttl 128, id 57820, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.22.3165 > google.com.http: S, cksum 0xd6a6 (correct), 3624270508:3624270508(0) win 65535 <mss 1460,nop,nop,sackok="">18:34:31.173166 IP (tos 0x0, ttl 127, id 46940, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.22.3165 > 192.168.165.12.3128: S, cksum 0xcc63 (correct), 3624270508:3624270508(0) win 65535 <mss 1460,nop,nop,sackok="">18:34:33.630977 IP (tos 0x0, ttl 128, id 57822, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.22.3164 > static-fxfeeds.nslb.sj.mozilla.com.http: S, cksum 0x4faf (correct), 364223045:364223045(0) win 65535 <mss 1460,nop,nop,sackok="">18:34:33.631202 IP (tos 0x0, ttl 127, id 35077, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.22.3164 > 192.168.165.12.3128: S, cksum 0xef1c (correct), 364223045:364223045(0) win 65535 <mss 1460,nop,nop,sackok="">18:34:34.133926 IP (tos 0x0, ttl 128, id 57824, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.22.3165 > google.com.http: S, cksum 0xd6a6 (correct), 3624270508:3624270508(0) win 65535 <mss 1460,nop,nop,sackok="">18:34:34.134204 IP (tos 0x0, ttl 127, id 4967, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.22.3165 > 192.168.165.12.3128: S, cksum 0xcc63 (correct), 3624270508:3624270508(0) win 65535 <mss 1460,nop,nop,sackok="">18:34:40.169236 IP (tos 0x0, ttl 128, id 57828, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.22.3165 > google.com.http: S, cksum 0xd6a6 (correct), 3624270508:3624270508(0) win 65535 <mss 1460,nop,nop,sackok="">18:34:40.169484 IP (tos 0x0, ttl 127, id 23104, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.22.3165 > 192.168.165.12.3128: S, cksum 0xcc63 (correct), 3624270508:3624270508(0) win 65535 <mss 1460,nop,nop,sackok="">18:34:52.153409 IP (tos 0x0, ttl 128, id 57843, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.22.3166 > google.com.http: S, cksum 0x9065 (correct), 3034145817:3034145817(0) win 65535 <mss 1460,nop,nop,sackok="">18:34:52.153934 IP (tos 0x0, ttl 127, id 33875, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.22.3166 > 192.168.165.12.3128: S, cksum 0x8622 (correct), 3034145817:3034145817(0) win 65535 <mss 1460,nop,nop,sackok="">18:34:52.176660 IP (tos 0x0, ttl 128, id 57859, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.22.3167 > google.com.http: S, cksum 0x522d (correct), 4197997809:4197997809(0) win 65535 <mss 1460,nop,nop,sackok="">18:34:52.177169 IP (tos 0x0, ttl 127, id 57198, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.22.3167 > 192.168.165.12.3128: S, cksum 0x47ea (correct), 4197997809:4197997809(0) win 65535 <mss 1460,nop,nop,sackok="">18:34:52.177205 IP (tos 0x0, ttl 128, id 57868, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.22.3168 > google.com.http: S, cksum 0xb1db (correct), 573101394:573101394(0) win 65535 <mss 1460,nop,nop,sackok="">18:34:52.177693 IP (tos 0x0, ttl 127, id 36447, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.22.3168 > 192.168.165.12.3128: S, cksum 0xa798 (correct), 573101394:573101394(0) win 65535 <mss 1460,nop,nop,sackok="">^C61 packets captured
65 packets received by filter
0 packets dropped by kernel

###This is the box running squid

mcserver# tcpdump -vv | grep -v ssh | grep -v NETBIOS | grep -v arp
tcpdump: listening on em0, link-type EN10MB (Ethernet), capture size 96 bytes
14:05:17.812138 IP (tos 0x0, ttl 127, id 46940, offset 0, flags [DF], proto: TCP (6), length: 48) pc01.3165 > 192.168.165.12.3128: S, cksum 0xcc63 (correct), 3624270508:3624270508(0) win 65535 <mss 1460,nop,nop,sackok="">14:05:17.812182 IP (tos 0x0, ttl  64, id 56558, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.12.3128 > pc01.3165: S, cksum 0xcb96 (incorrect (-> 0x56bc), 1961296304:1961296304(0) ack 3624270509 win 65535 <mss 1460,sackok,eol="">14:05:17.812384 IP (tos 0x0, ttl 128, id 57821, offset 0, flags [none], proto: TCP (6), length: 40) pc01.3165 > 192.168.165.12.3128: R, cksum 0x2670 (correct), 3624270509:3624270509(0) win 0
14:05:20.269458 IP (tos 0x0, ttl 127, id 35077, offset 0, flags [DF], proto: TCP (6), length: 48) pc01.3164 > 192.168.165.12.3128: S, cksum 0xef1c (correct), 364223045:364223045(0) win 65535 <mss 1460,nop,nop,sackok="">14:05:20.269496 IP (tos 0x0, ttl  64, id 56561, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.12.3128 > pc01.3164: S, cksum 0xcb96 (incorrect (-> 0x4c95), 1846752612:1846752612(0) ack 364223046 win 65535 <mss 1460,sackok,eol="">14:05:20.269706 IP (tos 0x0, ttl 128, id 57823, offset 0, flags [none], proto: TCP (6), length: 40) pc01.3164 > 192.168.165.12.3128: R, cksum 0x6be1 (correct), 364223046:364223046(0) win 0
14:05:20.772261 IP (tos 0x0, ttl 127, id 4967, offset 0, flags [DF], proto: TCP (6), length: 48) pc01.3165 > 192.168.165.12.3128: S, cksum 0xcc63 (correct), 3624270508:3624270508(0) win 65535 <mss 1460,nop,nop,sackok="">14:05:20.772277 IP (tos 0x0, ttl  64, id 56562, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.12.3128 > pc01.3165: S, cksum 0xcb96 (incorrect (-> 0xda37), 3146594190:3146594190(0) ack 3624270509 win 65535 <mss 1460,sackok,eol="">14:05:20.772511 IP (tos 0x0, ttl 128, id 57825, offset 0, flags [none], proto: TCP (6), length: 40) pc01.3165 > 192.168.165.12.3128: R, cksum 0x2670 (correct), 3624270509:3624270509(0) win 0
14:05:26.805793 IP (tos 0x0, ttl 127, id 23104, offset 0, flags [DF], proto: TCP (6), length: 48) pc01.3165 > 192.168.165.12.3128: S, cksum 0xcc63 (correct), 3624270508:3624270508(0) win 65535 <mss 1460,nop,nop,sackok="">14:05:26.805836 IP (tos 0x0, ttl  64, id 56563, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.12.3128 > pc01.3165: S, cksum 0xcb96 (incorrect (-> 0x7b85), 3471540962:3471540962(0) ack 3624270509 win 65535 <mss 1460,sackok,eol="">14:05:26.806038 IP (tos 0x0, ttl 128, id 57829, offset 0, flags [none], proto: TCP (6), length: 40) pc01.3165 > 192.168.165.12.3128: R, cksum 0x2670 (correct), 3624270509:3624270509(0) win 0
14:05:30.048918 IP (tos 0x0, ttl  64, id 56564, offset 0, flags [DF], proto: TCP (6), length: 44) 192.168.165.12.netbios-ssn > pc01.ncube-lm: P, cksum 0xcb92 (incorrect (-> 0x34d6), 3691487235:3691487239(4) ack 4080383168 win 65535
>>> NBT Session Packet
NBT Session Keepalive
Flags=0x0
Length=0 (0x0)

^C61 packets captured
62 packets received by filter
0 packets dropped by kernel

Sorry I suck at grep.</mss></mss></mss></mss></mss></mss></mss></mss></mss></mss></mss></mss></mss></mss></mss></mss></mss></mss></mss></mss></mss></mss></letpastsquid></letpastsquid>
                            1 Reply Last reply Reply Quote 0
                            • N
                              NovceGuru
                              last edited by

                              1. stop squid

                              2)mcserver# nc -l 3128

                              1. firefox http://192.168.165.10:3128

                              netcat returns:

                              GET / HTTP/1.1
                              Host: 192.168.165.10:3128
                              User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.4) Gecko/20070515 Firefox/2.0.0.4
                              Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,/;q=0.5
                              Accept-Language: en-us,en;q=0.5
                              Accept-Encoding: gzip,deflate
                              Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
                              Keep-Alive: 300
                              Connection: keep-alive

                              1. firefox http://google.com

                              netcat returns:

                              <nothing></nothing>

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.