External transparent proxy?
-
I would like to run squid on an external (to pfsense) LAN host and have it proxy transparently for LAN and OPT1 hosts. Is this possible, perhaps using redirect on pfsense to divert outbound connections to said LAN proxy host?
-
You can't do that if the squid box is on the same interface as the clients it is to proxy, because you can't redirect back out the same interface that the traffic enters.
If you have a third internal interface or VLAN to put the squid box on, you can redirect it in the way you describe.
-
That would work. Is it just a matter of installing the redirect package then adding a rule to redirect dport 80 to proxy:3128 then?
-
no need for a package. Just add a port forward on the LAN (and OPT1) interface, with an 'external address' of 'any' and destination port 80, and the NAT IP would be the squid box, and whatever port you have squid running on.
-
Sometimes it's even easier than we imagine. Thanks for your help.
