<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal>Hey,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I am missing a bit of the context, like:<o:p></o:p></p><p class=MsoNormal>Did you self compiled squid? Is it from the OS repository?<o:p></o:p></p><p class=MsoNormal>Squid -v might help a bit to understand what you do have enabled in your Squid.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Eliezer<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>----<o:p></o:p></p><p class=MsoNormal>Eliezer Croitoru<o:p></o:p></p><p class=MsoNormal>Tech Support<o:p></o:p></p><p class=MsoNormal>Mobile: +972-5-28704261<o:p></o:p></p><p class=MsoNormal>Email: <a href="mailto:ngtech1ltd@gmail.com"><span style='color:blue'>ngtech1ltd@gmail.com</span></a><o:p></o:p></p><p class=MsoNormal>Zoom: Coming soon<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p></div><p class=MsoNormal><o:p> </o:p></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b>From:</b> squid-users <squid-users-bounces@lists.squid-cache.org> <b>On Behalf Of </b>jean francois hasson<br><b>Sent:</b> Thursday, December 31, 2020 11:10 AM<br><b>To:</b> squid-users@lists.squid-cache.org<br><b>Subject:</b> [squid-users] Setting up a transparent http and https proxy server using squid 4.6<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><p>Hi,<o:p></o:p></p><p>I am trying to create for my home network a transparent proxy to implement filtering rules based on website names mainly.<o:p></o:p></p><p>I have been looking at using a Raspberry pi 3B+ running pi OS. I configured it to be a Wifi access point using RaspAP quick install. The Wifi network on which the filtering option is to be implemented is with IP 10.3.141.xxx. The router is at address 10.3.141.1.<o:p></o:p></p><p>I have the following squid.conf file which I tried to create based on different mails, websites and blogs I read :<o:p></o:p></p><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><p>acl SSL_ports port 443 #https<br>acl SSL_ports port 563 # snews<br>acl SSL_ports port 873 # rsync<br>acl Safe_ports port 80 # http<br>acl Safe_ports port 21 # ftp<br>acl Safe_ports port 443 # https<br>acl Safe_ports port 70 # gopher<br>acl Safe_ports port 210 # wais<br>acl Safe_ports port 1025-65535 # unregistered ports<br>acl Safe_ports port 280 # http-mgmt<br>acl Safe_ports port 488 # gss-http<br>acl Safe_ports port 591 # filemaker<br>acl Safe_ports port 777 # multiling http<br><br>#Le réseau local<br>acl LocalNet src 10.3.141.0/24<br><br>acl bump_step1 at_step SslBump1<br>acl bump_step2 at_step SslBump2<br>acl bump_step3 at_step SslBump3<br><br>#Définition des autorisations<br>http_access deny !Safe_ports<br>#http_access deny CONNECT !SSL_ports<br>http_access allow localhost manager<br>http_access deny manager<br>http_access allow localhost<br>http_access allow LocalNet<br>http_access deny all<br><br>#Définition des ports d'écoute<br>http_port 8080<br>http_port 3128 intercept<br>https_port 3129 intercept ssl-bump \<br> tls-cert=/etc/squid/cert/example.crt \<br> tls-key=/etc/squid/cert/example.key \<br> generate-host-certificates=on dynamic_cert_mem_cache_size=4MB<br><br>sslcrtd_program /usr/lib/squid/security_file_certgen -s /var/lib/ssl_db -M 4MB<br>sslcrtd_children 5<br><br>ssl_bump peek all<br>acl tls_whitelist ssl::server_name .example.com<br>ssl_bump splice tls_whitelist<br>ssl_bump terminate all<br><br>coredump_dir /var/spool/squid<br><br>refresh_pattern ^ftp: 1440 20% 10080<br>refresh_pattern ^gopher: 1440 0% 1440<br>refresh_pattern -i (/cgi-bin/|\?) 0 0% 0<br>refresh_pattern . 0 20% 4320<br><br>cache_dir ufs /cache 400 16 256<br>cache_access_log /var/log/squid/access.log<br>cache_effective_user proxy<o:p></o:p></p></blockquote><p>If I set up on a device connected to the access point a proxy manually ie 10.3.141.1 on port 8080, I can access the internet. If I put the following rules for iptables to use in files rules.v4 :<o:p></o:p></p><p>*nat<br>-A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.3.141.1:3128<br>-A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128<br>-A PREROUTING -i eth0 -p tcp -m tcp --dport 443 -j DNAT --to-destination 10.3.141.1:3129<br>-A PREROUTING -i eth0 -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 3129<br>-A POSTROUTING -s 10.3.141.0/24 -o eth0 -j MASQUERADE<br>COMMIT<br>Now, if I remove the manual proxy configuration of the device connected to the access point, I can't connect to the internet. If I leave the manual proxy configuration it does work and there is activity logged in /var/log/squid/access.log.<o:p></o:p></p><p>Please let me know what might be wrong in my configuration if possible.<o:p></o:p></p><p>Best regards,<o:p></o:p></p><p>JF<o:p></o:p></p><p><o:p> </o:p></p></div></body></html>