In business networks there is a big usage of transparent proxy also home networks can use it also.
Thanks to that kind of server we can monitoring a lot of meta data and value information from client network and also prevent a lot of virus infections.
Lets assume that our server (192.168.0.10) have Ubuntu or Debian operation system installed on it and the lan network is 192.168.0.0/24.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 |
#install squid apt-get install squid3 #lets make our own squid config file mv /etc/squid3/squid.conf /etc/squid3/squid.conf.bak vim /etc/squid3/squid.conf ###begging squid.conf ### debug_options ALL,1 acl localnet src 192.168.0.0/24 acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow localhost manager http_access deny manager http_access allow localnet http_access allow localhost http_access deny all http_port 192.168.0.10:8888 http_port 192.168.0.10:3128 intercept coredump_dir /var/spool/squid3 refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|?) 0 0% 0 refresh_pattern (Release|Packages(.gz)*)$ 0 20% 2880 refresh_pattern . 0 20% 4320 cache_dir /data/cache 100 16 256 cache_log /var/log/squid3/cache.log cache_mem 16 MB cache_mgr webmaster cache_replacement_policy lru cache_store_log /var/log/squid3/store.log cache_swap_high 95 cache_swap_low 90 client_lifetime 1 days connect_timeout 2 minutes error_directory /usr/share/squid3/errors/en ftp_passive on maximum_object_size 4096 KB memory_replacement_policy lru ### end squid.conf ### service squid |
On server there is also software firewall (iptables) which we will use to forward connection using commands below:
|
1 2 3 4 |
iptables -t nat -A PREROUTING -s 192.168.0.10 -p tcp --dport 80 -j ACCEPT iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 3128 iptables -t nat -A POSTROUTING -j MASQUERADE iptables -t mangle -A PREROUTING -p tcp --dport 3128 -j DROP |
Next, on Mikrotik router we will add firewall rules to forward chosen clients (via list SQUID_CLIENTS) to server with squid proxy:
|
1 2 3 4 5 6 7 8 9 10 |
/ip firewall mangle add chain=prerouting comment=squid dst-port=80 protocol=tcp src-address=192.168.0.10 add action=mark-routing chain=prerouting dst-port=80 in-interface=ether3 new-routing-mark=2 protocol=tcp src-address-list=SQUID_CLIENTS add chain=prerouting routing-mark=2 /ip firewall nat add action=masquerade chain=srcnat out-interface=ether1 src-address=192.168.0.0/24 /ip route add distance=1 gateway=192.168.0.10 routing-mark=2 |
This way we finished configuration of proxy server which will capture web traffic and don’t need to be configure on client side.
