Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Traffic Redirection with Port Forwards

    Scheduled Pinned Locked Moved NAT
    12 Posts 4 Posters 9.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • belleraB Offline
      bellera
      last edited by

      jimp

      1. I created an alias with 80, 443 and 8000:8100 ports.
      2. I put the alias at External port range.
      3. I put 3128 at Local port.

      WebGUI accepted this configuration and I can see at console (partial listing):

      pfctl -s nat

      rdr on em0 inet proto tcp from any to any port = http -> 192.168.2.12 port 3128
      rdr on em0 inet proto tcp from any to any port = https -> 192.168.2.12 port 3128
      rdr on em0 inet proto tcp from any to any port 8000:8100 -> 192.168.2.12 port 3128

      I think this should work. Do you agree?

      Regards,

      Josep Pujadas

      1 Reply Last reply Reply Quote 0
      • jimpJ Offline
        jimp Rebel Alliance Developer Netgate
        last edited by

        No, because the target port is considered the "starting" port of the destination range, from what I remember.

        Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

        Need help fast? Netgate Global Support!

        Do not Chat/PM for help!

        1 Reply Last reply Reply Quote 0
        • belleraB Offline
          bellera
          last edited by

          Ok, thanks!

          1 Reply Last reply Reply Quote 0
          • E Offline
            Efonnes
            last edited by

            Considering the output of pfctl -s nat, I think that should work, actually.

            1 Reply Last reply Reply Quote 0
            • belleraB Offline
              bellera
              last edited by

              Thanks, but finally I implemented another solution.

              I wanted to redirect 80, 443 and 8000-8100 to an external squid+squidguard proxy.

              But the problem is that a redirected external proxy requires to be configured as transparent.

              I don't like transparent proxies.

              Finally, I used WPAD detection based on DNS records in my network:

              http://forum.pfsense.org/index.php/topic,29452.0.html

              Thanks,

              Josep Pujadas

              1 Reply Last reply Reply Quote 0
              • D Offline
                dolphy
                last edited by

                Hi, Im having your problems, Im using an external squid proxy transparent + dansguardian
                Testing with squid + dansgaurdian is working fine on browser setting.
                But when using NAT to redirect to squid I got these errorsThe following error was encountered:

                • Unable to forward this request at this time.

                This request could not be forwarded to the origin server or to any parent caches. The most likely cause for this error is that:

                * The cache administrator does not allow this cache to make direct connections to origin servers, and
                    * All configured parent caches are currently unreachable.

                Your cache administrator is root.

                And log on squid box

                1290738384.951      2 10.0.10.3 TCP_NEGATIVE_HIT/504 1903 GET http://thoisuso.net/tin-khoa-hoc/hoi-nghi-tai-nga-mang-den-hy-vong-cho-loai-ho.html - NONE/- text/html
                1290738385.998      2 10.0.10.3 TCP_NEGATIVE_HIT/504 1903 GET http://thoisuso.net/tin-khoa-hoc/hoi-nghi-tai-nga-mang-den-hy-vong-cho-loai-ho.html - NONE/- text/html
                1290738397.254      2 10.0.10.3 TCP_DENIED/504 1569 GET http://thoisuso.net/ - NONE/- text/html
                1290738397.256      9 10.0.10.3 TCP_MISS/504 1670 GET http://thoisuso.net/ - DIRECT/27.0.14.21 text/html
                1290738397.259    20 10.0.10.3 TCP_MISS/504 1771 GET http://thoisuso.net/ - DIRECT/27.0.14.21 text/html
                1290738421.218      2 10.0.10.3 TCP_NEGATIVE_HIT/504 1778 GET http://thoisuso.net/ - NONE/- text/html

                can anybody got issues like this? Pls help.

                1 Reply Last reply Reply Quote 0
                • belleraB Offline
                  bellera
                  last edited by

                  Hi!

                  Revise your squid.conf.

                  squid must be in transparent mode. This means that transparent mode must be activated at squid.conf and you need to have squid compiled supporting transparent mode.

                  I don't know wich OS are you using. In FreeBSD is usual to download the package source and compile it. At this time FreeBSD ask for the configuration options of the package…

                  Be sure also wich networks are permitted as client (squid.conf and squidGuard.conf -in your case DansGuardian-). pfSense NATed network is the origine now for your squid, not the network client.

                  Regards,

                  Josep Pujadas

                  1 Reply Last reply Reply Quote 0
                  • D Offline
                    dolphy
                    last edited by

                    Hi Josep Pujadas,

                    Here is my config

                    http_port 10.0.10.3:3128 transparent
                    visible_hostname SQUID
                    cache_mem 512 MB
                    cache_dir ufs /srv/squid/cache 10000 16 256
                    access_log /srv/squid/logs/access.log squid
                    cache_log /srv/squid/logs/cache.log
                    cache_store_log /srv/squid/logs/store.log
                    acl all src 0.0.0.0/0.0.0.0
                    acl manager proto cache_object
                    acl localhost src 127.0.0.1/255.255.255.255
                    acl to_localhost dst 127.0.0.0/8
                    acl SSL_ports port 443
                    acl Safe_ports port 80          # http
                    acl Safe_ports port 21          # ftp
                    acl Safe_ports port 443        # https
                    acl Safe_ports port 70          # gopher
                    acl Safe_ports port 210        # wais
                    acl Safe_ports port 1025-65535  # unregistered ports
                    acl Safe_ports port 280        # http-mgmt
                    acl Safe_ports port 488        # gss-http
                    acl Safe_ports port 591        # filemaker
                    acl Safe_ports port 777        # multiling http
                    acl CONNECT method CONNECT

                    acl MyNetwork1 src 192.168.0.0/255.255.255.0

                    http_access allow  MyNetwork1

                    always_direct allow all
                    icp_access allow all
                    http_access deny all
                    coredump_dir /var/spool/squid

                    1 Reply Last reply Reply Quote 0
                    • belleraB Offline
                      bellera
                      last edited by

                      Try:

                      acl our_networks src 127.0.0.1/32 10.0.10.3/32 192.168.0.0/24
                      http_access allow our_networks
                      http_access deny all

                      localhost, your proxy and your network…

                      or try:

                      http_access allow all

                      restarting squid, to test if your problem is the source ip...

                      1 Reply Last reply Reply Quote 0
                      • D Offline
                        dolphy
                        last edited by

                        I tried, allow all already but still the same.
                        Seem likes Pfsense do translate the source ip to the squid ip (nat)

                        Here is the log

                        1290995342.128    75 10.0.10.3 TCP_MISS/504 1881 GET http://thoisuso.net/chuyen-xe/xe-nguoi-dep/nguoi-mau-o-trien-lam-essen.html - DIRECT/27.0.14.21 text/html
                        1290995343.950      2 10.0.10.3 TCP_NEGATIVE_HIT/504 1887 GET http://thoisuso.net/chuyen-xe/xe-nguoi-dep/nguoi-mau-o-trien-lam-essen.html - NONE/- text/html
                        1290995344.470      2 10.0.10.3 TCP_NEGATIVE_HIT/504 1887 GET http://thoisuso.net/chuyen-xe/xe-nguoi-dep/nguoi-mau-o-trien-lam-essen.html - NONE/- text/html
                        1290995344.703    57 10.0.10.3 TCP_NEGATIVE_HIT/504 1887 GET http://thoisuso.net/chuyen-xe/xe-nguoi-dep/nguoi-mau-o-trien-lam-essen.html - NONE/- text/html
                        1290995344.830    19 10.0.10.3 TCP_NEGATIVE_HIT/504 1887 GET http://thoisuso.net/chuyen-xe/xe-nguoi-dep/nguoi-mau-o-trien-lam-essen.html - NONE/- text/html

                        External squid with pfsense still not work right.  :'(

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.