[squid-users] Unsuccessful at using Squid v4 with intercept

[Antony Stone]

On Wednesday 30 October 2019 at 17:11:29, FOUTREL Sébastien wrote:

> Hello, I would like to use squid as a transparent proxy for my users.

> "Clients" are behind a Debian "Router" which MASQUERADE them (as they use
> RFC 1918 ips).
> 
> I have a Squid 4.6 from Debian Buster packages installed on a "Proxy"
> server which is outside my network.
> 
> I read a lot of tutorials and examples from squid site...

Did that include the links I've given below?

> I Applied a DNAT to trafic coming from Clients thru Router to Proxy.
> 
> iptables -tnat -A PREROUTING -i LAN_3500 -p tcp -m tcp --dport 80 -j DNAT
> --to-destination <Proxy>:3129

Have you put this rule onto the firewall you mention, or the Squid box itself?

https://wiki.squid-cache.org/SquidFaq/InterceptionProxy
#Requirements_and_methods_for_Interception_Caching

states "NAT configuration will only work when used *on the squid box* ."

So, you *must* put that rule on the Squid machine itself, not on the firewall.

It goes on to say "To intercept from a gateway machine and direct traffic at a 
separate squid box use policy routing." with a link to 
https://wiki.squid-cache.org/ConfigExamples/Intercept/IptablesPolicyRoute

> HTTP is coming to squid successfully but squid logs show a request coming
> from proxy himself and a request coming from Router (as Clients are NATed
> by Router)

Ah, so you *are* doing the NAT on the router :)  Don't :)

> if I allow in squid.conf the Proxy IP, I end up with a Forward loop...
> 
> 
> I also tried the tproxy scenario with no success.

Well, give us some details of what you tried, how you configured it, what 
worked, and what didn't work, and we might be able to help, otherwise we can 
only say "well, tproxy does work if set up properly, so if yours doesn't work, 
it isn't set up properly", which isn't a very helpful answer...


Antony.

-- 
If at first you don't succeed, destroy all the evidence that you tried.

                                                   Please reply to the list;
                                                         please *don't* CC me.