<div dir="ltr">Hi Amos<div>Thanks for the elaborate reply, I highly appreciate it. I did flush iptables and re-applied from scratch, see : </div><div><br></div><div>
<p class=""><span class="">[root@kgoDcyTx9 ~]# iptables -nL -t nat</span></p>
<p class=""><span class="">Chain PREROUTING (policy ACCEPT)</span></p>
<p class=""><span class="">target prot opt source destination </span></p>
<p class=""><span class="">ACCEPT tcp -- 162.220.xx.xx <a href="http://0.0.0.0/0">0.0.0.0/0</a> tcp dpt:443 </span></p>
<p class=""><span class="">ACCEPT tcp -- 162.220.xx.xx <a href="http://0.0.0.0/0">0.0.0.0/0</a> tcp dpt:80 </span></p>
<p class=""><span class="">REDIRECT tcp -- <a href="http://0.0.0.0/0">0.0.0.0/0</a> <a href="http://0.0.0.0/0">0.0.0.0/0</a> tcp dpt:80 redir ports 3128 </span></p>
<p class=""><span class="">REDIRECT tcp -- <a href="http://0.0.0.0/0">0.0.0.0/0</a> <a href="http://0.0.0.0/0">0.0.0.0/0</a> tcp dpt:443 redir ports 3129 </span></p>
<p class=""><span class=""></span><br></p>
<p class=""><span class="">Chain POSTROUTING (policy ACCEPT)</span></p>
<p class=""><span class="">target prot opt source destination </span></p>
<p class=""><span class="">MASQUERADE all -- <a href="http://0.0.0.0/0">0.0.0.0/0</a> <a href="http://0.0.0.0/0">0.0.0.0/0</a> </span></p>
<p class=""><span class=""></span><br></p>
<p class=""><span class="">Chain OUTPUT (policy ACCEPT)</span></p>
<p class=""><span class="">target prot opt source destination </span></p>
<p class=""><span class="">[root@kgoDcyTx9 ~]# iptables -nL </span></p>
<p class=""><span class="">Chain INPUT (policy ACCEPT)</span></p>
<p class=""><span class="">target prot opt source destination </span></p>
<p class=""><span class=""></span><br></p>
<p class=""><span class="">Chain FORWARD (policy ACCEPT)</span></p>
<p class=""><span class="">target prot opt source destination </span></p>
<p class=""><span class=""></span><br></p>
<p class=""><span class="">Chain OUTPUT (policy ACCEPT)</span></p>
<p class=""><span class="">target prot opt source destination </span></p><p class=""><span class=""><br></span></p><p class=""><span class=""><br></span></p><p class=""><span class="">The problem is I am still getting the same freaking loop : see below please, any more input to try please ?</span></p><p class=""><span class=""><br></span></p><p style="font-family:verdana,sans-serif;color:rgb(30,30,30);font-size:12px">The following error was encountered while trying to retrieve the URL: <a href="https://162.220.244.7/*">https://162.220.xx.xx/*</a></p><blockquote id="error" style="font-family:verdana,sans-serif;color:rgb(30,30,30);font-size:12px"><p><b>Connection to 162.220.xx.xx failed.</b></p></blockquote><p class=""><span class=""><span style="color:rgb(30,30,30);font-family:verdana,sans-serif;font-size:12px">The system returned:</span><span style="color:rgb(30,30,30);font-family:verdana,sans-serif;font-size:12px"> </span><i style="color:rgb(30,30,30);font-family:verdana,sans-serif;font-size:12px">(111) Connection refused</i> </span></p></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Mar 7, 2016 at 4:57 AM, Amos Jeffries <span dir="ltr"><<a href="mailto:squid3@treenet.co.nz" target="_blank">squid3@treenet.co.nz</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On 7/03/2016 2:50 p.m., Ali Jawad wrote:<br>
> Hi<br>
> Pardon me if I am mistaken but isnt it the case that 1 :<br>
><br>
> iptables -t nat -A PREROUTING -p tcp --dport 443 --destination<br>
> 162.220.xx.xx -j REDIRECT --to-ports 3129<br>
> The rule above would only match for the IP of squid and squid should be<br>
> heading to the actual IP of the site in question which is not on the same<br>
> server<br>
<br>
</span>Squid itself is *never* a valid destination IP on intercepted traffic.<br>
The purpose of the REDIRECT/DNAT is to make it a destination when it did<br>
not start that way.<br>
<br>
If you meant to write " ! --destination", you would be correct. However<br>
the difficulty you already had in using the '!' correctly is a good<br>
reason why we dont demo that way. Its just plain difficult for beginners<br>
to understand whats going on (and some experts even).<br>
<br>
Also, the ! mechanism does not cope well with multiple IPs on the Squid<br>
machine. In the modern Internet every machine in existence always has a<br>
minimum of between 3 and 6 IPs, maybe more if the admin active assigns<br>
multiple global IPs. They all need to be excluded for the protection to<br>
be fully effective.<br>
<span class=""><br>
<br>
><br>
> and 2 :<br>
><br>
> If Squid is intercepting the PREROUTING chain would not apply anymore, as<br>
> traffic passing through local daemons goes through OUTPUT and POSTROUTING<br>
> chains<br>
<br>
</span>If the packets stayed within the Squid machine that would be right.<br>
However outgoing packets with Squid IP as the destination can reach the<br>
switch to which Squid is plugged in and "bounce" right back in through<br>
all the normal PREROUTING logics. Infinite loop and very much pain<br>
trying to figure out what is going on.<br>
<span class=""><br>
><br>
> As for<br>
><br>
> iptables -t nat -A PREROUTING -s $SQUIDIP -p tcp --dport 80 -j ACCEPT<br>
><br>
<br>
</span>Both the -s parameter here and the mangle table rule are pre-emptively<br>
truncating the NAT loop so that the packets end up being routed normally<br>
instead of diverted into that Squid intercept port. They also<br>
simultaneously prevent external attacks on the NAT system (and Squid)<br>
from remote clients.<br>
<br>
As mentioned above the --destination way(s) of doing things both does<br>
not scale to all the IPs on the current machine, and is far less easy<br>
for beginners to understand. So it is a multiple-win situation to do it<br>
the way we demo.<br>
<span class=""><br>
><br>
> All traffic set to ACCEPT ..thanks !<br>
<br>
<br>
</span>Not all traffic hopefully. Just the stuff outgoing / generated by Squid<br>
itself :-P<br>
<span class="HOEnZb"><font color="#888888"><br>
Amos<br>
<br>
</font></span></blockquote></div><br></div>