<div dir="ltr"><div>Sure. So we have a few internal networks that aren't meant to have direct internet access without access through a proxy so that it can be better regulated and monitored. <br></div><div><br></div><div>That being said, we've previously used a microsoft product that is EOL and I thought I could do much of what it's wanting with Linux and squid and nginx for reverse proxy. <br></div><div><br></div><div>We've got several internal subnets that need to be able to talk through squid (I've chosen tcp/8080) to connect to from internally and want to translate that to an external IP address that does have access to the outside world. Using the acl's that squid provides and allowing for various ports (80/443, etc) I'd like to use this functionality. <br></div><div><br></div><div>Once again, the squid server has two IP addresses. One internal, and one external. The outbound traffic would be accessible through that external ip. <br></div><div><br></div><div>I hope I'm making <i>some</i><i></i> sense. :)</div><div><br></div><div>Thanks<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Apr 13, 2020 at 3:38 PM Antony Stone <<a href="mailto:Antony.Stone@squid.open.source.it">Antony.Stone@squid.open.source.it</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Monday 13 April 2020 at 21:19:04, Chris Bidwell - NOAA Federal wrote:<br>
<br>
> Hi all,<br>
> <br>
> Very new to squid and am looking to setup several internal subnets to<br>
> access external network (internet) through squid on a separate interface.<br>
<br>
What are you trying to achieve by using Squid? What is your objective, <br>
compared to giving clients direct access to the Internet?<br>
<br>
> Server has two IP's. One private internal and one public. Can someone<br>
> point me in the right direction to get this setup? Running RHEL7.<br>
<br>
Firstly, install Squid and look at its configuration file. It is *very* well <br>
commented / documented, and there is *very* little you need to change in order <br>
to get it working on your network.<br>
<br>
For more details, see:<br>
<br>
<a href="https://wiki.squid-cache.org/SquidFaq/BinaryPackages" rel="noreferrer" target="_blank">https://wiki.squid-cache.org/SquidFaq/BinaryPackages</a><br>
<br>
<a href="https://wiki.squid-cache.org/SquidFaq/ConfiguringSquid" rel="noreferrer" target="_blank">https://wiki.squid-cache.org/SquidFaq/ConfiguringSquid</a><br>
<a href="https://wiki.squid-cache.org/SquidFaq" rel="noreferrer" target="_blank">https://wiki.squid-cache.org/SquidFaq</a><br>
<a href="https://wiki.squid-cache.org/ConfigExamples" rel="noreferrer" target="_blank">https://wiki.squid-cache.org/ConfigExamples</a><br>
<br>
<a href="https://www.packtpub.com/squid-proxy-server-31-beginners-guide/book" rel="noreferrer" target="_blank">https://www.packtpub.com/squid-proxy-server-31-beginners-guide/book</a><br>
<a href="http://www.oreilly.com/catalog/squid/" rel="noreferrer" target="_blank">http://www.oreilly.com/catalog/squid/</a><br>
<br>
(All the above available from <a href="http://www.squid-cache.org" rel="noreferrer" target="_blank">http://www.squid-cache.org</a> )<br>
<br>
<br>
> Do I need to create static routes?<br>
<br>
Provided the machine you want install Squid on can reach (a) arbitrary web <br>
servers on the Internet, and (b) the client machines on your internal <br>
networks, then no.<br>
<br>
If not, then yes, you will need to add suitable routes so that the Squid <br>
server can find both origin servers and clients.<br>
<br>
> Do I need firewalld rules in place?<br>
<br>
A firewall is always a good idea, however Squid imposes no special requirement <br>
of its own here.<br>
<br>
A very good starting point for firewalls is "allow the traffic you know you want, <br>
block the traffic you know you do not want, and log and block the traffic you're <br>
not sure about - then look at the logs and adjust the rules as necessary to <br>
keep the log entries minimal".<br>
<br>
<br>
Finally, if you run into problems, come back here and tell us:<br>
<br>
- what you want to achieve<br>
- what you did to try to achieve it<br>
- how you tested whether it worked<br>
- what you found which told you it didn't work<br>
<br>
Basically, give us enough information to understand what you're trying to do, <br>
what you've done to get there, and what went wrong (such that we could <br>
reproduce the problem for ourselves if need be), and people here will happily <br>
help out.<br>
<br>
<br>
Regards,<br>
<br>
<br>
Antony.<br>
<br>
-- <br>
Pavlov is in the pub enjoying a pint.<br>
The barman rings for last orders, and Pavlov jumps up exclaiming "Damn! I <br>
forgot to feed the dog!"<br>
<br>
Please reply to the list;<br>
please *don't* CC me.<br>
_______________________________________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
</blockquote></div><br clear="all"><br>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><br></div><div><span style="color:rgb(136,136,136);font-size:12.8px">Chris Bidwell, CISSP</span><br style="color:rgb(136,136,136);font-size:12.8px"><span style="color:rgb(136,136,136);font-size:12.8px">Space Weather Prediction Center</span><br style="color:rgb(136,136,136);font-size:12.8px"><span style="color:rgb(136,136,136);font-size:12.8px">National Oceanic Atmospheric Administration</span><br style="color:rgb(136,136,136);font-size:12.8px"><span style="color:rgb(136,136,136);font-size:12.8px">email: </span><a href="mailto:cbidwell@usgs.gov" style="color:rgb(17,85,204);font-size:12.8px" target="_blank">c</a><a href="mailto:hris.bidwell@noaa.gov" target="_blank">hris.bidwell@noaa.gov</a></div><div>office: 303-497-3204<br style="font-size:12.8px"><span style="color:rgb(136,136,136);font-size:12.8px">mobile: 720-496-3126</span><br></div></div></div></div></div></div></div></div></div></div></div>