Sign up ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have setup a basic Squid + DansGuardian virtual machine that I was to use for the monitoring and blocking of certain websites. Currently, web traffic goes through a router set as the gateway - the IP address of this is handed out by a DHCP service on a Linux server. I'd like to route some clients to a different gateway, based on their MAC address (which I can do already). The setup is as follows:

Router (Gateway) -
DHCP/DNS Server  -
Squid Server     -
Client PCs       -

However, most tutorials seem to require that Squid accepts traffic on 1 NIC and then relays it to the outside world on another NIC, on a different subnet.

Is it possible to have Squid accept traffic on it's IP ( and relay it to the gateway ( to leave the building as normal? If so, does anyone have the relevant iptables rules they could give me?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

You need not to have the separate interface for this purpose.

Just add a rule to redirect the HTTP traffic and to NAT the rest appropriately:

iptables -t nat -A PREROUTING -i eth0 -m iprange --src-range -p tcp --dport 80 -j REDIRECT --to-port 3128
iptables -t nat -A POSTROUTING -o eth0 -m iprange --src-range -j SNAT --to-source

It is assumed, that the default policy for all chains is set to accept. Also, you will need the ipv4 forwarding to be enabled at this host and it's default gateway should be set to

share|improve this answer
Thanks, that's done the job nicely – fistameeny Oct 25 '12 at 12:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.