transparent proxy squid

[jamesbo]

how to redirect trafic to squid on other ip address?

 

[Jeffrey Young]

First thought is to set a forward rule in the GUI (WAN->Port Forwarding).

Also a little more detail would help.

 

[jamesbo]

thank you. i want to redirect http traffic to transparent proxy on 192.168.0.15:7766. tried with prerouting on iptables w/o success..

 

[Jeffrey Young]

From the WAN? Using the port forwarding section I referred to will do the job.

 

[jamesbo]

no just local traffic. i am not interested in rev proxy just squid cache for my lan.

 

[Jeffrey Young]

Ahh, gotcha.

 

[Jeffrey Young]

Assuming you are using squid as a reverse proxy of sorts for web traffic, add the squid server fqdn name and address in /jffs/configs/hosts.add file and restart dnsmasq.

 

[ColinTaylor]

no just local traffic. i am not interested in rev proxy just squid cache for my lan.

As most web traffic is HTTPS you will get certificate errors if you simply try to redirect traffic to squid. You need to set the proxy details in the clients' browser settings. That might be possible by using WPAD but that is disabled by default in the router's DHCP server.

 

[DocUmibozu]

thank you. i want to redirect http traffic to transparent proxy on 192.168.0.15:7766. tried with prerouting on iptables w/o success..

Old school idea.
It was good when everything was http.
Now everything is https, so It won't easily work.
I suggest to abandon the idea and configure the clients to use your proxy.
If you really want to do it you need something like this:

1. Client starts HTTPS session
2. Proxy transparently intercepts the connection and returns an ad-hoc generated certificate X, signed by a certificate authority that is unconditionally trusted by the client.
3. Proxy starts HTTPS session to target
4. Proxy verifies integrity of SSL certificate; displays error if the cert is not valid.
5. Proxy streams content, decrypts it and re-encrypts it with X
6. Client displays stuff.

To achieve it you need something like this: http://wiki.squid-cache.org/Features/SslBump

 

[Jeffrey Young]

Sorry, yeah, I have been using reverse proxies so much lately that it totally went by me that you were setting up a foreward proxy. Sorry about the confusuion that I have caused.

Curious though, is your squid server located on the router (entware) or another machne? Looking at the documentation for squid, the iptables rules to redirect incoming port 80/443 traffic to the squid ports is done on the same machine that is running squid. That makes sense to me.