Transparent Proxy help please



  • Hi to all,
    i've the following problem :

    • WAN ( internet )
    • WIFI LAN proxy trasparent
    • WIFI GUEST LAN proxy trasparent

    I've installed squid in transparent way and :
    1. configured the proxy inside the browser configuration work
    2. access via wifi lan and transparent proxy don't work

    Here my configuration for squid.conf :

    
    http_port 10.178.102.10:3128
    http_port 10.178.101.10:3128
    http_port 10.178.64.45:3128
    http_port 127.0.0.1:3128 intercept
    icp_port 0
    dns_v4_first on
    pid_filename /var/run/squid/squid.pid
    cache_effective_user squid
    cache_effective_group proxy
    error_default_language af
    icon_directory /usr/local/etc/squid/icons
    visible_hostname localhost
    cache_mgr it@prontoseat.it
    access_log /var/squid/logs/access.log
    cache_log /var/squid/logs/cache.log
    cache_store_log none
    netdb_filename /var/squid/logs/netdb.state
    pinger_enable on
    pinger_program /usr/local/libexec/squid/pinger
    
    logfile_rotate 60
    debug_options rotate=60
    shutdown_lifetime 3 seconds
    forwarded_for on
    uri_whitespace strip
    
    acl dynamic urlpath_regex cgi-bin \?
    cache deny dynamic
    
    cache_mem 1024 MB
    maximum_object_size_in_memory 32 KB
    memory_replacement_policy heap GDSF
    cache_replacement_policy heap LFUDA
    minimum_object_size 0 KB
    maximum_object_size 4 MB
    cache_dir ufs /var/squid/cache 1024 16 256
    offline_mode off
    cache_swap_low 90
    cache_swap_high 95
    cache allow all
    # Add any of your own refresh_pattern entries above these.
    refresh_pattern ^ftp:    1440  20%  10080
    refresh_pattern ^gopher:  1440  0%  1440
    refresh_pattern -i (/cgi-bin/|\?) 0  0%  0
    refresh_pattern .    0  20%  4320
    #Remote proxies
    
    # Setup some default acls
    # From 3.2 further configuration cleanups have been done to make things easier and safer. The manager, localhost, and to_localhost ACL definitions are now built-in.
    # acl localhost src 127.0.0.1/32
    acl allsrc src all
    acl safeports port 21 70 80 210 280 443 488 563 591 631 777 901  3128 3129 1025-65535
    acl sslports port 443 563
    
    # From 3.2 further configuration cleanups have been done to make things easier and safer. The manager, localhost, and to_localhost ACL definitions are now built-in.
    #acl manager proto cache_object
    
    acl purge method PURGE
    acl connect method CONNECT
    
    # Define protocols used for redirects
    acl HTTP proto HTTP
    acl HTTPS proto HTTPS
    acl allowed_subnets src 10.178.64.0/24 10.178.101.0/24 10.178.102.0/24
    http_access allow manager localhost
    
    http_access deny manager
    http_access allow purge localhost
    http_access deny purge
    http_access deny !safeports
    http_access deny CONNECT !sslports
    
    # Always allow localhost connections
    # From 3.2 further configuration cleanups have been done to make things easier and safer.
    # The manager, localhost, and to_localhost ACL definitions are now built-in.
    # http_access allow localhost
    
    request_body_max_size 0 KB
    delay_pools 1
    delay_class 1 2
    delay_parameters 1 -1/-1 -1/-1
    delay_initial_bucket_level 100
    delay_access 1 allow allsrc
    
    # Reverse Proxy settings
    # Custom options before auth
    
    # Setup allowed ACLs
    http_access allow allowed_subnets
    # Default block all to be sure
    http_access deny allsrc
    
    icap_enable on
    icap_send_client_ip on
    icap_send_client_username on
    icap_client_username_encode off
    icap_client_username_header X-Authenticated-User
    icap_preview_enable on
    icap_preview_size 1024
    
    icap_service service_avi_req reqmod_precache icap://127.0.0.1:1344/squid_clamav bypass=off
    adaptation_access service_avi_req allow all
    icap_service service_avi_resp respmod_precache icap://127.0.0.1:1344/squid_clamav bypass=on
    adaptation_access service_avi_resp allow all
    

    Tha Outgoing NAT is disabled and all the rules of firewall are opened from any to any.

    here some TCPDUMP :

    
    11:39:31.103032 IP 10.178.101.22.50953 > 54.251.185.0.80: Flags [s], seq 870956397, win 65535, options [mss 1460,sackOK,TS val 18584763 ecr 0,nop,wscale 8], length 0
    11:39:31.897679 IP 10.178.101.22.43410 > 93.184.219.82.80: Flags [s], seq 2998714420, win 65535, options [mss 1460,sackOK,TS val 18584842 ecr 0,nop,wscale 8], length 0
    11:39:31.915661 IP 10.178.101.22.36045 > 104.124.103.123.80: Flags [s], seq 2949361445, win 65535, options [mss 1460,sackOK,TS val 18584845 ecr 0,nop,wscale 8], length 0
    11:39:31.915852 IP 10.178.101.22.57419 > 173.192.220.64.80: Flags [s], seq 1030590641, win 65535, options [mss 1460,sackOK,TS val 18584845 ecr 0,nop,wscale 8], length 0
    11:39:31.915864 IP 10.178.101.22.43170 > 104.124.114.245.80: Flags [s], seq 780154735, win 65535, options [mss 1460,sackOK,TS val 18584845 ecr 0,nop,wscale 8], length 0
    11:39:31.925744 IP 10.178.101.22.41925 > 104.98.161.166.80: Flags [s], seq 2971572904, win 65535, options [mss 1460,sackOK,TS val 18584846 ecr 0,nop,wscale 8], length 0
    11:39:31.925848 IP 10.178.101.22.40907 > 172.217.16.142.80: Flags [s], seq 2351124715, win 65535, options [mss 1460,sackOK,TS val 18584846 ecr 0,nop,wscale 8], length 0
    11:39:31.937240 IP 10.178.101.22.37658 > 172.217.16.136.80: Flags [s], seq 427864817, win 65535, options [mss 1460,sackOK,TS val 18584847 ecr 0,nop,wscale 8], length 0
    11:39:31.946495 IP 10.178.101.22.41966 > 54.154.106.213.80: Flags [s], seq 4224886699, win 65535, options [mss 1460,sackOK,TS val 18584848 ecr 0,nop,wscale 8], length 0
    [/s][/s][/s][/s][/s][/s][/s][/s][/s]
    


  • Now worked only with this NAT rule.

    Whi Squid don't forward the traffic with transparent mode checked ?




  • No one have any solution ?

    I have read a lot of documents, but nothing find to resolve the redirect inside the configuration of transparent proxy.



  • I haven't find any solution without add the NAT rules.

    Someone can confirm me  that is the corrrect way to working with transparent proxy ? ( but I don't understand the check boc "transparent proxy" )

    Thanks in advance.