Transparent proxy -> internal squid host but preserving source IP address



  • I have an internal server running squid which all internal hosts are being forced through via a NAT port forward and Outbound NAT rule.  On the squid host, all traffic appears to be coming from the pfsense host.  I'd like to see the individual client IPs making the requests.

    Is this possible without running squid on pfsense itself?

    NAT Port forward rule:
    If: LAN
    Proto: TCP
    Src: !squidhost
    Src ports: *
    Dest addr: *
    Dest ports: 80
    NAT IP: squidhost
    NAT ports: 3128

    NAT Outbound rule:
    If: LAN
    Src: LAN subnet
    Src port: tcp/*
    Dest addr: squidhost
    Dest port: tcp/3128
    NAT Address: LAN address
    NAT ports: *
    Static port: NO



  • It appears someone was able to accomplish this 9 years ago, but the instructions don't translate well to the current version.

    https://forum.pfsense.org/index.php?topic=4225.0

    Has anyone been able to setup a transparent proxy on pfsense that forwards traffic to an internal squid server but preserves the source IP addresses?