[squid-users] Enable tproxy in Squid 3.5 running on Debian 9

[Amos Jeffries]

On 05/10/17 15:01, xpro6000 wrote:
> I'm trying to setup tproxy with Squid 3.5 for the purpose of having the 
> same outgoing ip as the connecting ip. (I have thousands of IPs and I 
> can not add them one by one)
> 
> I started with a fresh install of Debian 9, installed Squid by
> 
> apt install squid
> 
> then I added
> 
> http_port 3129 tproxy
> 
> to squid.conf
> 
> I then ran the following commands for iptables
> 
> iptables -t mangle -N DIVERT
> iptables -t mangle -A DIVERT -j MARK --set-mark 1
> iptables -t mangle -A DIVERT -j ACCEPT
> 
> iptables  -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
> 
> iptables  -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY 
> --tproxy-mark 0x1/0x1 --on-port 3129
> 
> 
> I can use the proxy with no problems on port 3128, but on Firefox I get 
> a message "The proxy server is refusing connections" when I set the 
> proxy to port 3129. Did I miss any steps or am I doing something wrong?

You missed the fact that TPROXY is an MITM operation. You *cannot* setup 
the browser to use the proxy directly to its tproxy port. You have to 
route the packets to the proxy machine without any explicit browser or 
client configuration.

Only the Squid machine bits (and thus behaviour) are different with 
TPROXY vs NAT interception.

...
> http_access deny !Safe_ports
> http_access deny CONNECT !SSL_ports
> http_access allow localhost manager
> http_access deny manager
> http_access allow localhost
> http_access allow all

Do not do "allow all" like this. Setup the localnet ACL to your LAN 
range(s) properly and only allow those clients through the proxy.

Then you can use the recommended default:
  http_access deny !Safe_ports
  http_access deny CONNECT !SSL_ports
  http_access allow localhost
  http_access deny manager
  http_access allow localnet
  http_access deny all

Amos