Easy home transparent proxy
Everyone in South Africa wants to save a little more bandwidth, as low traffic caps are the rule of the day (esp if you are hanging off an expensive 3G connection).
While the "correct" thing to do is to use wpad autodetection, and thus politely request that users use your proxy, this isn't always an option:
- Firefox doesn't Autodetect Proxies by default
- Autodetection doesn't behave well for many roaming users (firefox should talk to network-manager)
- Many programs simply don't support wpad.
- Your upstream ISP transparently proxies anyway (the norm in ZA), so it's not like we have any end-to-endness to protect.
So, here's how you do it:
- Lets assume your network is 10.1.1.0/24, and the squid box is 10.1.1.1 on eth0
- Install squid (
aptitude install squid), configure it to have a reasonably large storage pool, give it some sane ACLs, etc.
http_port 8080 transparentto
http_port 10.1.1.1:8080 transparentif you are using explicit
invoke-rc.d squid reload
- Add the following to your iptables script:
iptables -t nat -A PREROUTING -i eth0 -s 10.1.1.0/24 -d ! 10.20.1.1 -p tcp --dport 80 -j REDIRECT --to 8080
If you run squid on your network's default gateway, then you are done. Otherwise, if you have a separate router, you need to do the following on the router:
- Add a new
- Pick a new netfilter MARK value, i.e. 0x04
Add the following to the router's iptables script:
# Transparent proxy iptables -t mangle -F PREROUTING iptables -t mangle -A PREROUTING -i br-lan -s ! 10.1.1.1 -d ! 10.1.1.0/24 -p tcp --dport 80 -j MARK --set-mark 0x04 ip route del table transprox ip route add default via 10.1.1.1 table transprox ip rule del table transprox ip rule add fwmark 0x04 pref 10 table transprox
Done: test and tail your squid logs
The reason we use
iproute rules rather than
iptables DNAT is that you lose destination-IP information with a DNAT (like the envelope of an e-mail).
An alternative solution is to run tinyproxy on the router (with the transparent option, enabled in ubuntu but not debian), use the REDIRECT rule above on the router, to redirect to the tinyproxy, and have that
upstream to the squid. But tinyproxy requires some RAM, and on a WRT54 or the likes, you don't have any of that to spare...
Should you need to temporarily disable this for any reason:
- With all-in-one-router:
iptables -t nat -F PREROUTING
- With the separate router:
iptables -t mangle -F PREROUTING