set https proxy with squid and iptables
have a Linux as router, eth0 (192.168.0.60) connect to LAN, eth1 (10.100.33.239) connect to Internet. squid works well, I can set 10.100.33.239:3128 or 192.168.0.60:3128 as proxy in web browser and visit http and https web-site.
now, I want to use iptables to setup transparent proxy, which means I can visit web site without setting proxy in my web browser.
Now, http is OK, but https is failed. would someone help me? thank you!
iptables config
iptables -t filter -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A FORWARD -i eth0 -p tcp --dport 443 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to-source 10.100.33.239
iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.0.60:3128
iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
iptables https squid
asked Feb 3 '13 at 15:47
siyuansiyuan
4828
add a comment |
have a Linux as router, eth0 (192.168.0.60) connect to LAN, eth1 (10.100.33.239) connect to Internet. squid works well, I can set 10.100.33.239:3128 or 192.168.0.60:3128 as proxy in web browser and visit http and https web-site.
now, I want to use iptables to setup transparent proxy, which means I can visit web site without setting proxy in my web browser.
Now, http is OK, but https is failed. would someone help me? thank you!
iptables config
iptables -t filter -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A FORWARD -i eth0 -p tcp --dport 443 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to-source 10.100.33.239
iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.0.60:3128
iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
iptables https squid
asked Feb 3 '13 at 15:47
siyuansiyuan
4828
Have you configured squid correctly ? wiki.squid-cache.org/Features/HTTPS
– Lawrence
Feb 26 '14 at 12:17
add a comment |
have a Linux as router, eth0 (192.168.0.60) connect to LAN, eth1 (10.100.33.239) connect to Internet. squid works well, I can set 10.100.33.239:3128 or 192.168.0.60:3128 as proxy in web browser and visit http and https web-site.
now, I want to use iptables to setup transparent proxy, which means I can visit web site without setting proxy in my web browser.
Now, http is OK, but https is failed. would someone help me? thank you!
iptables config
iptables -t filter -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A FORWARD -i eth0 -p tcp --dport 443 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to-source 10.100.33.239
iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.0.60:3128
iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
iptables https squid
asked Feb 3 '13 at 15:47
siyuansiyuan
4828
have a Linux as router, eth0 (192.168.0.60) connect to LAN, eth1 (10.100.33.239) connect to Internet. squid works well, I can set 10.100.33.239:3128 or 192.168.0.60:3128 as proxy in web browser and visit http and https web-site.
now, I want to use iptables to setup transparent proxy, which means I can visit web site without setting proxy in my web browser.
Now, http is OK, but https is failed. would someone help me? thank you!
iptables config
iptables -t filter -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A FORWARD -i eth0 -p tcp --dport 443 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to-source 10.100.33.239
iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.0.60:3128
iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
iptables https squid
iptables https squid
asked Feb 3 '13 at 15:47
siyuansiyuan
4828
asked Feb 3 '13 at 15:47
siyuansiyuan
4828
edited Feb 3 '13 at 23:19
siyuan
asked Feb 3 '13 at 15:47
siyuansiyuan
4828
asked Feb 3 '13 at 15:47
siyuansiyuan
4828
asked Feb 3 '13 at 15:47
siyuansiyuan
4828
4828
Have you configured squid correctly ? wiki.squid-cache.org/Features/HTTPS
– Lawrence
Feb 26 '14 at 12:17
add a comment |
Have you configured squid correctly ? wiki.squid-cache.org/Features/HTTPS
– Lawrence
Feb 26 '14 at 12:17
Have you configured squid correctly ? wiki.squid-cache.org/Features/HTTPS
– Lawrence
Feb 26 '14 at 12:17
Have you configured squid correctly ? wiki.squid-cache.org/Features/HTTPS
– Lawrence
Feb 26 '14 at 12:17
add a comment |
1 Answer
1
active
oldest
votes
You need also forward eth0 incomes on port 443 to squid listen port 3128, to be able using transparent proxy for the https requests.
Try to add this to your iptable:
iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.0.60:3128
iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 3128
answered Feb 26 '14 at 0:21
2i3r2i3r
23210
can you expand at all?
– Sickest
Feb 26 '14 at 3:08
It seems to not work well, I didn't tried it before, some instructions offer sets different port for https and generate and set certificate for this purpose (like this one: liknk). so just forwarding the 443 port, may not be a complete solution. but I'm not sure why setting IP/port of proxy sever, is fine for https requests but when we want to make it transparent NAT table forwarding is not enough.
– 2i3r
Feb 26 '14 at 11:24
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f545972%2fset-https-proxy-with-squid-and-iptables%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
You need also forward eth0 incomes on port 443 to squid listen port 3128, to be able using transparent proxy for the https requests.
Try to add this to your iptable:
iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.0.60:3128
iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 3128
answered Feb 26 '14 at 0:21
2i3r2i3r
23210
can you expand at all?
– Sickest
Feb 26 '14 at 3:08
It seems to not work well, I didn't tried it before, some instructions offer sets different port for https and generate and set certificate for this purpose (like this one: liknk). so just forwarding the 443 port, may not be a complete solution. but I'm not sure why setting IP/port of proxy sever, is fine for https requests but when we want to make it transparent NAT table forwarding is not enough.
– 2i3r
Feb 26 '14 at 11:24
add a comment |
You need also forward eth0 incomes on port 443 to squid listen port 3128, to be able using transparent proxy for the https requests.
Try to add this to your iptable:
iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.0.60:3128
iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 3128
answered Feb 26 '14 at 0:21
2i3r2i3r
23210
can you expand at all?
– Sickest
Feb 26 '14 at 3:08
It seems to not work well, I didn't tried it before, some instructions offer sets different port for https and generate and set certificate for this purpose (like this one: liknk). so just forwarding the 443 port, may not be a complete solution. but I'm not sure why setting IP/port of proxy sever, is fine for https requests but when we want to make it transparent NAT table forwarding is not enough.
– 2i3r
Feb 26 '14 at 11:24
add a comment |
You need also forward eth0 incomes on port 443 to squid listen port 3128, to be able using transparent proxy for the https requests.
Try to add this to your iptable:
iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.0.60:3128
iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 3128
answered Feb 26 '14 at 0:21
2i3r2i3r
23210
You need also forward eth0 incomes on port 443 to squid listen port 3128, to be able using transparent proxy for the https requests.
Try to add this to your iptable:
iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.0.60:3128
iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 3128
answered Feb 26 '14 at 0:21
2i3r2i3r
23210
edited Feb 26 '14 at 11:27
answered Feb 26 '14 at 0:21
2i3r2i3r
23210
answered Feb 26 '14 at 0:21
2i3r2i3r
23210
answered Feb 26 '14 at 0:21
2i3r2i3r
23210
23210
can you expand at all?
– Sickest
Feb 26 '14 at 3:08
It seems to not work well, I didn't tried it before, some instructions offer sets different port for https and generate and set certificate for this purpose (like this one: liknk). so just forwarding the 443 port, may not be a complete solution. but I'm not sure why setting IP/port of proxy sever, is fine for https requests but when we want to make it transparent NAT table forwarding is not enough.
– 2i3r
Feb 26 '14 at 11:24
add a comment |
can you expand at all?
– Sickest
Feb 26 '14 at 3:08
It seems to not work well, I didn't tried it before, some instructions offer sets different port for https and generate and set certificate for this purpose (like this one: liknk). so just forwarding the 443 port, may not be a complete solution. but I'm not sure why setting IP/port of proxy sever, is fine for https requests but when we want to make it transparent NAT table forwarding is not enough.
– 2i3r
Feb 26 '14 at 11:24
can you expand at all?
– Sickest
Feb 26 '14 at 3:08
can you expand at all?
– Sickest
Feb 26 '14 at 3:08
It seems to not work well, I didn't tried it before, some instructions offer sets different port for https and generate and set certificate for this purpose (like this one: liknk). so just forwarding the 443 port, may not be a complete solution. but I'm not sure why setting IP/port of proxy sever, is fine for https requests but when we want to make it transparent NAT table forwarding is not enough.
– 2i3r
Feb 26 '14 at 11:24
It seems to not work well, I didn't tried it before, some instructions offer sets different port for https and generate and set certificate for this purpose (like this one: liknk). so just forwarding the 443 port, may not be a complete solution. but I'm not sure why setting IP/port of proxy sever, is fine for https requests but when we want to make it transparent NAT table forwarding is not enough.
– 2i3r
Feb 26 '14 at 11:24
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f545972%2fset-https-proxy-with-squid-and-iptables%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Have you configured squid correctly ? wiki.squid-cache.org/Features/HTTPS
– Lawrence
Feb 26 '14 at 12:17