[squid-users] Transparent proxy with squid and Dansguardian

[Darren B.]

HI

I am trying to set up a router that allows a group of devices on a 
network to access the internet via Dansguardian and squid.

I am setting it up as a transparent proxy and locking down the ports 
with IPtables.

I am using IPtables to redirect connections on port 80 from the client 
and remap them to 8080 for dansguardian, dans is then set up to talk to 
squid on 127.0.0.1:3128

the iptables rules are

iptables -A PREROUTING -p tcp -m tcp -i eth1 --dport 80 -j REDIRECT 
--to-ports 8080
iptables -A POSTROUTING -j MASQUERADE

if I set the rule above to REDIRECT to 3128, the cache works as 
expected. If I set it above, I can see traffic in DG and in the cache 
log of squid but the target IF address is stripped out and I seem to be 
getting a forwarding loop.

I am not sure what is going on but it seems that Dansguardian is 
rewriting the target address and getting squid to loop back on itself.

All the various versions are current to ubuntu 14.04 although the 
dansguardian is a little old in this distro.

Any pointers would be greatly appreciated.


Darren B.




Currently the processes running and listening are

root at dnsmasq:~# netstat -ntlp | grep LISTEN
tcp        0      0 0.0.0.0:53              0.0.0.0:* LISTEN      
1068/dnsmasq
tcp        0      0 0.0.0.0:22              0.0.0.0:* LISTEN      1022/sshd
tcp        0      0 0.0.0.0:3128            0.0.0.0:* LISTEN      
1610/squid3
tcp        0      0 0.0.0.0:8080            0.0.0.0:* LISTEN      
4202/dansguardian
tcp        0      0 0.0.0.0:10000           0.0.0.0:* LISTEN      1149/perl
tcp6       0      0 :::53                   :::* LISTEN      1068/dnsmasq
tcp6       0      0 :::22                   :::* LISTEN      1022/sshd
tcp6       0      0 :::3129                 :::* LISTEN      1610/squid3


Squid config is currently this

acl localnet1 src 172.25.101.0/24       # RFC1918 possible internal network
acl localnet2 src 172.25.102.0/24       # RFC1918 possible internal network
acl localnet3 src 172.25.103.0/24       # RFC1918 possible internal network

acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT

http_access allow localhost
http_access allow localnet1
http_access allow localnet2
http_access allow localnet3

http_access deny !Safe_ports

always_direct allow all

http_access deny CONNECT !SSL_ports

cache_effective_user proxy
cache_effective_group proxy

# http_access deny manager

http_port 3128 intercept
http_port 3129

debug_options All,2 78,5

cache_dir ufs /mnt/ksn/squid/cache 100 16 256

coredump_dir /var/spool/squid3

refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern (Release|Packages(.gz)*)$      0       20%     2880
refresh_pattern .               0       20%     4320

#Performance Tuning Options
hosts_file /etc/hosts
dns_nameservers 127.0.0.1
cache_replacement_policy heap LFUDA
cache_swap_low 90
cache_swap_high 95
#cache_mem 200MB
logfile_rotate 10
memory_pools off
maximum_object_size 50 MB
maximum_object_size_in_memory 50 KB
quick_abort_min 0 KB
quick_abort_max 0 KB
log_icp_queries off
client_db off
buffered_logs on
half_closed_clients off