Implementing a global proxy with iptables

Question

I'm running a Linux box (Lubuntu 12.04) in an Windows environment where a pac file is used to configure internet access.

proxy.pac file:

function FindProxyForURL(url, host){
  var proxy_yes = "PROXY xxx.xxx.xxx.xxx:8000";
  var proxy_no = "DIRECT";
  if (shExpMatch(url, "*//yyy.*")) { return proxy_no; }
  if (shExpMatch(url, "*//zzz.zzz.*")) { return proxy_no; }
  if (shExpMatch(url, "*foo.com*")) { return proxy_no; }
  //Proxy anything else
  return proxy_yes;
}

Lubuntu, as far as I know, has no global proxy system.

Instead of trying to mess around with shell variables like HTTP_PROXY that only some programs respect (not Chromium, for instance), I was thinking that iptables could be used to transparently redirect all traffic through the proxy, effectively implementing a global proxy.

Is this possible, and if it is, how would I go about doing it?

EDIT: I should clarify that I'm not an administrator, nor am I trying to set up a proxy. The proxy is already set up and getting machines to connect to the interent requires enabling automatic proxy configuration and pointing it at the pac file above. Direct connections are blocked.

Instead of configuring every application individually I was hoping to use iptables to automatically route the traffic over the proxy.

Answer 1

I confess I've never used Lubuntu before, but I suspect it's just a Ubuntu derivative running in a virtual machine. Relying on javascript to do your proxying is a very silly thing to do, as it is easily bypassed or completely ignored in many cases... which ultimately defeats the advantages of using a proxy to start with.

I would start by setting up a proper proxy system using squid. For ubuntu derivatives, there is a squid package in the repository that is easily installed using apt or synaptic. After installing, start by editing the /etc/squid/squid.conf and add or modify the following settings with those you deem appropriate:

httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_uses_host_header on
acl lan src 192.168.1.1 192.168.2.0/24
http_access allow localhost
http_access allow lan

There are a lot more configuration options you can use, but these are a pretty good start for most uses. After that, the next step is simply to configure iptables in your default router to DNAT and redirect traffic to your squid proxy.

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to 192.168.1.1:3128
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128

Of course, you'd want to put that in some sort of startup script so the rules are applied every time your router boots. Additionally, keep in mind that this will not affect https traffic, as https is deliberately designed to NOT allow traffic to be proxied (or intercepted/decrypted/etc by someone in the middle). If you wish to filter out traffic (to questionable sites), you can also throw SquidGuard into the mix.

It is possible to proxy https traffic, but it's highly not-recommended. If you are really-wanting to implement that functionality, there's a good guide here.

Answer 2

This is what I ended up doing:

• Setting the environment variables ALL_PROXY, HTTP_PROXY, HTTPS_PROXY, FTP_PROXY, and NO_PROXY in /etc/environment.
• Setting the http, https, and ftp proxies for apt in /etc/apt/apt.conf.d/80proxy (using the syntax Acquire::http::proxy "http://xxx.xxx.xxx.xxx:8000";)
• Using proxychains for any remaining programs that don't respect the environment variables and don't have built-in support for proxies.