Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Redirect web traffic to Squid on internal LAN

    Scheduled Pinned Locked Moved Firewalling
    13 Posts 2 Posters 15.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      dwadson
      last edited by

      In my config.xml, here's how my Squid "pool" is setup:

      <lbpool><type>gateway</type>
                              <behaviour>failover</behaviour>
                              <monitorip><name>squid</name>
                              <desc>Squid Transparent Proxy</desc>
                              <port><servers>192.168.0.12|192.168.0.12</servers></port></monitorip></lbpool>

      My LAN firewall rule to redirect traffic is:
      Proto      Source    Port    Destination    Port        Gateway
      TCP      !squid   *             *   80 (HTTP) squid

      You'll also need a rule on your Squid box to redirect the port 80 requests to the Squid port (probably 3128)

      1 Reply Last reply Reply Quote 0
      • N
        NovceGuru
        last edited by

        Thanks for the reply. Technically could I run the squid to listen on port 80? I do not have a firewall on the internal box. Thanks again.

        NovceGuru

        1 Reply Last reply Reply Quote 0
        • D
          dwadson
          last edited by

          You don't necessarily need a whole firewall running on your Squid box. Mine, running on CentOS, has a single iptables rule:

          iptables -t nat -A PREROUTING -i eth0 -d ! 192.168.0.12 -p tcp –dport 80 -j REDIRECT --to-ports 8080

          There's some sort of reason as to why the transparent proxy runs on a different port that I'll admit I'm not 100% sure on. It might simply be so that it doesn't conflict with a webserver running on the squid box.

          But first thing that you need to get working right is to have the port 80 traffic getting redirected out your Squid "gateway" on the pfSense box.

          1 Reply Last reply Reply Quote 0
          • N
            NovceGuru
            last edited by

            Thanks again for the reply.

            My squid box is running FreeBSD without a firewall, It's to bad I can't do that redirecting from the pfSense box. I think if that's not possible (which I assume it is not) I can just alias a free LAN address and run squid on port 80 on that box. I'll report back with what I find. Unfortunately I can't test this at the moment with people at the location of the box.

            NovceGuru

            1 Reply Last reply Reply Quote 0
            • N
              NovceGuru
              last edited by

              I have these settings:

              but the requests for some reason do not make it to 192.168.165.10, when I run tcpdump and make a request, my web client times out, but the logs show it allowing to connect. Thanks.

              NovceGuru

              1 Reply Last reply Reply Quote 0
              • D
                dwadson
                last edited by

                The only significant difference I can see between your pfSense and mine is that I'm running one of the latest snapshots - 1.2-BETA-1-TESTING-SNAPSHOT-05-29-2007.

                However, i thought I had this working on 1.0.1 before. Maybe not though.

                It does appear that your packets are going through the firewall as mine are so you should probably turn your attention now to the Squid box to confirm that it's receiving the packets. It might simply be having Apache with MySAR running on it that makes me run my Squid on a different port.

                1 Reply Last reply Reply Quote 0
                • N
                  NovceGuru
                  last edited by

                  I might try the latest 1.2 beta. I aliased an ip address and bound squid to it, and setup apache to bind to the other address. I can access squid via my browser @ 192.168.165.12 (and reconfigured the pool and firewall rule to reflect these changes) and the packets never seem to hit the squid box.  :'( :'(

                  1 Reply Last reply Reply Quote 0
                  • N
                    NovceGuru
                    last edited by

                    Sadly still a no go on 1.2-BETA-1, I had to hand edit the xml file to make it reflect yours.

                    <servers>192.168.0.12|192.168.0.12</servers> was WAN:192.168.165.12 (that didn't work either)

                    back to the drawing board…

                    NovceGuru

                    1 Reply Last reply Reply Quote 0
                    • N
                      NovceGuru
                      last edited by

                      Mucking around via SSH I added

                      rdr on sis0 proto tcp from ! <letpastsquid>to any port 80 -> 192.168.165.12 port 3128</letpastsquid>

                      to rules.debug, and pfctl -f rules.debug and atleast got the packets to reach the squid box, but it basically does the same thing as before–> times out

                      1 Reply Last reply Reply Quote 0
                      • N
                        NovceGuru
                        last edited by

                        May I see your squid.conf? Although I am using it right now with it configured in the browser, and I think the only "special" thing I need is http_port 192.168.165.10:3128 transparent

                        Thanks,

                        NovceGuru

                        1 Reply Last reply Reply Quote 0
                        • N
                          NovceGuru
                          last edited by 

                          #this is the firewall, it has:

table <letpastsquid>{ 192.168.165.10 192.168.165.12 }
rdr on sis0 proto tcp from ! <letpastsquid>to any port 80 -> 192.168.165.12 port 3128
in pf.conf

pfsense:/tmp#  tcpdump -vv | grep -v ssh | grep -v NETBIOS | grep -v arp
tcpdump: listening on sis0, link-type EN10MB (Ethernet), capture size 96 bytes
18:34:31.172636 IP (tos 0x0, ttl 128, id 57820, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.22.3165 > google.com.http: S, cksum 0xd6a6 (correct), 3624270508:3624270508(0) win 65535 <mss 1460,nop,nop,sackok="">18:34:31.173166 IP (tos 0x0, ttl 127, id 46940, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.22.3165 > 192.168.165.12.3128: S, cksum 0xcc63 (correct), 3624270508:3624270508(0) win 65535 <mss 1460,nop,nop,sackok="">18:34:33.630977 IP (tos 0x0, ttl 128, id 57822, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.22.3164 > static-fxfeeds.nslb.sj.mozilla.com.http: S, cksum 0x4faf (correct), 364223045:364223045(0) win 65535 <mss 1460,nop,nop,sackok="">18:34:33.631202 IP (tos 0x0, ttl 127, id 35077, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.22.3164 > 192.168.165.12.3128: S, cksum 0xef1c (correct), 364223045:364223045(0) win 65535 <mss 1460,nop,nop,sackok="">18:34:34.133926 IP (tos 0x0, ttl 128, id 57824, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.22.3165 > google.com.http: S, cksum 0xd6a6 (correct), 3624270508:3624270508(0) win 65535 <mss 1460,nop,nop,sackok="">18:34:34.134204 IP (tos 0x0, ttl 127, id 4967, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.22.3165 > 192.168.165.12.3128: S, cksum 0xcc63 (correct), 3624270508:3624270508(0) win 65535 <mss 1460,nop,nop,sackok="">18:34:40.169236 IP (tos 0x0, ttl 128, id 57828, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.22.3165 > google.com.http: S, cksum 0xd6a6 (correct), 3624270508:3624270508(0) win 65535 <mss 1460,nop,nop,sackok="">18:34:40.169484 IP (tos 0x0, ttl 127, id 23104, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.22.3165 > 192.168.165.12.3128: S, cksum 0xcc63 (correct), 3624270508:3624270508(0) win 65535 <mss 1460,nop,nop,sackok="">18:34:52.153409 IP (tos 0x0, ttl 128, id 57843, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.22.3166 > google.com.http: S, cksum 0x9065 (correct), 3034145817:3034145817(0) win 65535 <mss 1460,nop,nop,sackok="">18:34:52.153934 IP (tos 0x0, ttl 127, id 33875, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.22.3166 > 192.168.165.12.3128: S, cksum 0x8622 (correct), 3034145817:3034145817(0) win 65535 <mss 1460,nop,nop,sackok="">18:34:52.176660 IP (tos 0x0, ttl 128, id 57859, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.22.3167 > google.com.http: S, cksum 0x522d (correct), 4197997809:4197997809(0) win 65535 <mss 1460,nop,nop,sackok="">18:34:52.177169 IP (tos 0x0, ttl 127, id 57198, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.22.3167 > 192.168.165.12.3128: S, cksum 0x47ea (correct), 4197997809:4197997809(0) win 65535 <mss 1460,nop,nop,sackok="">18:34:52.177205 IP (tos 0x0, ttl 128, id 57868, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.22.3168 > google.com.http: S, cksum 0xb1db (correct), 573101394:573101394(0) win 65535 <mss 1460,nop,nop,sackok="">18:34:52.177693 IP (tos 0x0, ttl 127, id 36447, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.22.3168 > 192.168.165.12.3128: S, cksum 0xa798 (correct), 573101394:573101394(0) win 65535 <mss 1460,nop,nop,sackok="">^C61 packets captured
65 packets received by filter
0 packets dropped by kernel

###This is the box running squid

mcserver# tcpdump -vv | grep -v ssh | grep -v NETBIOS | grep -v arp
tcpdump: listening on em0, link-type EN10MB (Ethernet), capture size 96 bytes
14:05:17.812138 IP (tos 0x0, ttl 127, id 46940, offset 0, flags [DF], proto: TCP (6), length: 48) pc01.3165 > 192.168.165.12.3128: S, cksum 0xcc63 (correct), 3624270508:3624270508(0) win 65535 <mss 1460,nop,nop,sackok="">14:05:17.812182 IP (tos 0x0, ttl  64, id 56558, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.12.3128 > pc01.3165: S, cksum 0xcb96 (incorrect (-> 0x56bc), 1961296304:1961296304(0) ack 3624270509 win 65535 <mss 1460,sackok,eol="">14:05:17.812384 IP (tos 0x0, ttl 128, id 57821, offset 0, flags [none], proto: TCP (6), length: 40) pc01.3165 > 192.168.165.12.3128: R, cksum 0x2670 (correct), 3624270509:3624270509(0) win 0
14:05:20.269458 IP (tos 0x0, ttl 127, id 35077, offset 0, flags [DF], proto: TCP (6), length: 48) pc01.3164 > 192.168.165.12.3128: S, cksum 0xef1c (correct), 364223045:364223045(0) win 65535 <mss 1460,nop,nop,sackok="">14:05:20.269496 IP (tos 0x0, ttl  64, id 56561, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.12.3128 > pc01.3164: S, cksum 0xcb96 (incorrect (-> 0x4c95), 1846752612:1846752612(0) ack 364223046 win 65535 <mss 1460,sackok,eol="">14:05:20.269706 IP (tos 0x0, ttl 128, id 57823, offset 0, flags [none], proto: TCP (6), length: 40) pc01.3164 > 192.168.165.12.3128: R, cksum 0x6be1 (correct), 364223046:364223046(0) win 0
14:05:20.772261 IP (tos 0x0, ttl 127, id 4967, offset 0, flags [DF], proto: TCP (6), length: 48) pc01.3165 > 192.168.165.12.3128: S, cksum 0xcc63 (correct), 3624270508:3624270508(0) win 65535 <mss 1460,nop,nop,sackok="">14:05:20.772277 IP (tos 0x0, ttl  64, id 56562, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.12.3128 > pc01.3165: S, cksum 0xcb96 (incorrect (-> 0xda37), 3146594190:3146594190(0) ack 3624270509 win 65535 <mss 1460,sackok,eol="">14:05:20.772511 IP (tos 0x0, ttl 128, id 57825, offset 0, flags [none], proto: TCP (6), length: 40) pc01.3165 > 192.168.165.12.3128: R, cksum 0x2670 (correct), 3624270509:3624270509(0) win 0
14:05:26.805793 IP (tos 0x0, ttl 127, id 23104, offset 0, flags [DF], proto: TCP (6), length: 48) pc01.3165 > 192.168.165.12.3128: S, cksum 0xcc63 (correct), 3624270508:3624270508(0) win 65535 <mss 1460,nop,nop,sackok="">14:05:26.805836 IP (tos 0x0, ttl  64, id 56563, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.165.12.3128 > pc01.3165: S, cksum 0xcb96 (incorrect (-> 0x7b85), 3471540962:3471540962(0) ack 3624270509 win 65535 <mss 1460,sackok,eol="">14:05:26.806038 IP (tos 0x0, ttl 128, id 57829, offset 0, flags [none], proto: TCP (6), length: 40) pc01.3165 > 192.168.165.12.3128: R, cksum 0x2670 (correct), 3624270509:3624270509(0) win 0
14:05:30.048918 IP (tos 0x0, ttl  64, id 56564, offset 0, flags [DF], proto: TCP (6), length: 44) 192.168.165.12.netbios-ssn > pc01.ncube-lm: P, cksum 0xcb92 (incorrect (-> 0x34d6), 3691487235:3691487239(4) ack 4080383168 win 65535
>>> NBT Session Packet
NBT Session Keepalive
Flags=0x0
Length=0 (0x0)

^C61 packets captured
62 packets received by filter
0 packets dropped by kernel

Sorry I suck at grep.</mss></mss></mss></mss></mss></mss></mss></mss></mss></mss></mss></mss></mss></mss></mss></mss></mss></mss></mss></mss></mss></mss></letpastsquid></letpastsquid>
                          1 Reply Last reply Reply Quote 0
                          • N
                            NovceGuru
                            last edited by

                            1. stop squid

                            2)mcserver# nc -l 3128

                            1. firefox http://192.168.165.10:3128

                            netcat returns:

                            GET / HTTP/1.1
                            Host: 192.168.165.10:3128
                            User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.4) Gecko/20070515 Firefox/2.0.0.4
                            Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,/;q=0.5
                            Accept-Language: en-us,en;q=0.5
                            Accept-Encoding: gzip,deflate
                            Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
                            Keep-Alive: 300
                            Connection: keep-alive

                            1. firefox http://google.com

                            netcat returns:

                            <nothing></nothing>

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.