Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I rented space on a server with a static IP address, and I would like to set up a transparent proxy on this server.

After configuring the Squid for testing purposes with the listener http_access allow all, I wanted to set the iptables information. I have only one Ethernet connection with my static IP address mounted. I looked for some documentation on how to do this with a single NIC, but I couldn't find any. (There's plenty out there for two or more, but not for a single NIC.)

Currently it gives me this output:

root@1:~# ifconfig
lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:49 errors:0 dropped:0 overruns:0 frame:0
          TX packets:49 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:3536 (3.5 KB)  TX bytes:3536 (3.5 KB)

venet0    Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:127.0.0.1  P-t-P:127.0.0.1  Bcast:0.0.0.0  Mask:255.255.255.255
          inet6 addr: ::2/128 Scope:Compat
          inet6 addr: 2a01:[....]external-ipv6[...]/128 Scope:Global
          UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1
          RX packets:551353 errors:0 dropped:0 overruns:0 frame:0
          TX packets:455717 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:351211942 (351.2 MB)  TX bytes:267054641 (267.0 MB)

venet0:0  Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:[...]external-ipv4[...]  P-t-P:[...]external-ipv4[...]  Bcast:0.0.0.0  Mask:255.255.255.255
          UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1

I'm not really sure where I should go from here. My iptables are complete empty at the moment. Do I need ebtables for a correctly working transparent proxy, or are the correct iptables enough to get this done without ebtables? If so, is there an easy command you could give me to set them?

Sources:

#

especially this quote should explain me how to do this but i dont get it...

Next, I had added following rules to forward all http requests (coming to port 80) to the Squid server port 3128 :

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to 192.168.1.1:3128
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128

with

iptables -t nat -A PREROUTING -i venet0 -p tcp --dport 80 -j DNAT --to 127.0.0.1:3128
iptables -t nat -A PREROUTING -i venet0:0 -p tcp --dport 80 -j REDIRECT --to-port 3128

this should work, but it doesnt...

share|improve this question
    
I found some paper here: purplealienplanet.com/node/25 [...]Both eth0 and eth0:0 are configured static, with eth0 the part that will talk to the internet gateway, and eth0:0 the part that will talk to our local network. Afte[...] the autor explaines there how to do this, but im not familar with the iptable setting. i think with: iptables -t nat -A PREROUTING -i venet0 -p tcp --dport 80 -j DNAT --to 127.0.0.1:3128 # iptables -t nat -A PREROUTING -i venet0:0 -p tcp --dport 80 -j REDIRECT --to-port 3128 –  highThere Dec 7 '13 at 16:29
    
What are you wanting to configure the firewall to do ? (eg if its only for you, and you are coming from a static IP / range, tell us that). If you are wanting anyone to be able to use this, but protect against other possible attack venues, tell us that. –  davidgo Dec 7 '13 at 18:38
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.