Question about Computers & Internet

1 Answer

LINUX SQUID SERVER IN TRANSPARENT MODE

How can i add an IP in my squid server and ip-table which could have full access, like no restriction and all...

Posted by on

Ad

1 Answer

  • Level 2:

    An expert who has achieved level 2 by getting 100 points

    MVP:

    An expert that gotĀ 5 achievements.

    Governor:

    An expert whose answer gotĀ voted for 20 times.

    Hot-Shot:

    An expert who has answered 20 questions.

  • Expert
  • 55 Answers

Dear Friend....
The examples below are based on the discussion of Linux iptables in Chapter 14, "Linux Firewalls Using iptables". Additional commands may be necessary for you particular network topology.
In both cases below, the firewall is connected to the Internet on interface eth0 and to the home network on interface eth1. The firewall is also the default gateway for the home network and handles network address translation on all the network's traffic to the Internet.
Only the Squid server has access to the Internet on port 80 (HTTP), because all HTTP traffic, except that coming from the Squid server, is redirected.
If the Squid server and firewall are the same server, all HTTP traffic from the home network is redirected to the firewall itself on the Squid port of 3128 and then only the firewall itself is allowed to access the Internet on port 80.
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 \
-j REDIRECT --to-port 3128
iptables -A INPUT -j ACCEPT -m state \
--state NEW,ESTABLISHED,RELATED -i eth1 -p tcp \
--dport 3128
iptables -A OUTPUT -j ACCEPT -m state \
--state NEW,ESTABLISHED,RELATED -o eth0 -p tcp \
--dport 80
iptables -A INPUT -j ACCEPT -m state \
--state ESTABLISHED,RELATED -i eth0 -p tcp \
--sport 80
iptables -A OUTPUT -j ACCEPT -m state \
--state ESTABLISHED,RELATED -o eth1 -p tcp \
--sport 80
Note: This example is specific to HTTP traffic. You won't be able to adapt this example to support HTTPS web browsing on TCP port 443, as that protocol specifically doesn't allow the insertion of a "man in the middle" server for security purposes. One solution is to add IP masquerading statements for port 443, or any other important traffic, immediately after the code snippet. This will allow non HTTP traffic to access the Internet without being cached by Squid.
If the Squid server and firewall are different servers, the statements are different. You need to set up iptables so that all connections to the Web, not originating from the Squid server, are actually converted into three connections; one from the Web browser client to the firewall and another from the firewall to the Squid server, which triggers the Squid server to make its own connection to the Web to service the request. The Squid server then gets the data and replies to the firewall which then relays this information to the Web browser client. The iptables program does all this using these NAT statements:
iptables -t nat -A PREROUTING -i eth1 -s ! 192.168.1.100 \
-p tcp --dport 80 -j DNAT --to 192.168.1.100:3128
iptables -t nat -A POSTROUTING -o eth1 -s 192.168.1.0/24 \
-d 192.168.1.100 -j SNAT --to 192.168.1.1
iptables -A FORWARD -s 192.168.1.0/24 -d 192.168.1.100 \
-i eth1 -o eth1 -m state
--state NEW,ESTABLISHED,RELATED \
-p tcp --dport 3128 -j ACCEPT
iptables -A FORWARD -d 192.168.1.0/24 -s 192.168.1.100 \
-i eth1 -o eth1 -m state --state ESTABLISHED,RELATED \
-p tcp --sport 3128 -j ACCEPT
In the first statement all HTTP traffic from the home network except from the Squid server at IP address 192.168.1.100 is redirected to the Squid server on port 3128 using destination NAT. The second statement makes this redirected traffic also undergo source NAT to make it appear as if it is coming from the firewall itself. The FORWARD statements are used to ensure the traffic is allowed to flow to the Squid server after the NAT process is complete. The unusual feature is that the NAT all takes place on one interface; that of the home network (eth1).
You will additionally have to make sure your firewall has rules to allow your Squid server to access the Internet on HTTP TCP port 80 as covered in Chapter 14, "Linux Firewalls Using iptables".

Good Luck!

Posted on Jun 22, 2009

Ad

1 Suggested Answer

6ya6ya
  • 2 Answers

SOURCE: I have freestanding Series 8 dishwasher. Lately during the filling cycle water hammer is occurring. How can this be resolved

Hi,
a 6ya expert can help you resolve that issue over the phone in a minute or two.
best thing about this new service is that you are never placed on hold and get to talk to real repairmen in the US.
the service is completely free and covers almost anything you can think of (from cars to computers, handyman, and even drones).
click here to download the app (for users in the US for now) and get all the help you need.
goodluck!

Posted on Jan 02, 2017

Ad

Add Your Answer

Uploading: 0%

my-video-file.mp4

Complete. Click "Add" to insert your video. Add

×

Loading...
Loading...

Related Questions:

2 Answers

How to speed up my net


Hello

Here you go;

Windows XP change DNS server
You can Click on Start button > Settings > Network connections
Double click on Local Area Connection or your Internet connection
Click on Properties button
Select Internet Protocol (TCP/IP)
Click on Properties button and Look for Preferred DNS Server:
Setup NS1 - 208.67.222.222
Setup NS2 - 208.67.220.220

Save and close the windows. If you are using old version of windows you may need to reboot the system.

To test new setting go to Start > Run > Type cmd
Type nslookup command
Now type domain name
yahoo.com
google.com

Linux change DNS server
Please read following tnstructions:
http://www.cyberciti.biz/nixcraft/vi...dns-client.php

If you are using a Linux, you can further increase speed by installing squid local proxy server and dns dnsmasq caching server.
http://www.cyberciti.biz/nixcraft/vi...ormance-on.php

For more information, see their website http://opendns.com/

- -

Good Luck

Please rate

Jan 20, 2009 | Microsoft Windows XP Home Edition

Tip

How to divide bandwidth in squid


What is Bandwidth throttling :

Consider we are having 512Kbps Internet connection line. And the system administrator wants to divide the whole bandwidth into two sections. Read More One for the normal users and the other for special users who need high speed internet connection. So that all the normal users can use 256 Kbps and the special users can use the remaining 256 Kbps. So in this case you have to make a bandwidth throttling to differentiate the whole single pipe line into two sections. This can be achieved using squid proxy server.

Squid main configuration file ----- /etc/squid/squid.conf
Squid log file ----- /var/log/squid/access.log
Cache log file ----- /var/log/squid/cache.log

Bandwidth throttling in squid is done using Delay Pools. Delay pools uses bucketing system.

Throttle Calculations
512Kbps(Kilo bits per second) -----> 64Kbytes -----> 64000bytes
256Kbps -----> 32Kbytes -----> 32000bytes
128Kbps -----> 16Kbytes -----> 16000bytes
64Kbps -----> 8Kbytes -----> 8000bytes

Points to remember in Delay Pools:
There are basically three things to note, they are - delay pools, delay class, delay parameters.

Delay pool --- Defines how many pools we want to use
Delay Class ---- Defines type of the pool you are going to use.
Delay Parameter � allots the restrictions and fill rate/maximum bucket size.

As I have said previously in this documentation delay pools uses bucketing system.
Now there are three types of buckets

Class 1 pool: A single aggregate bucket, shared by all users
Class 2 pool: One aggregate bucket, 256 individual buckets
Class 3 pool: One aggregate bucket, 256 network buckets, 65,536 individual buckets

If you still have any problem in the above syntax (ie) aggregate, network and individual buckets to understand, then here is a simple syntax/example for all these

For Class 1 delay pool
delay_parameters 1 32000/32000

For Class 2 delay pool
delay_parameters 1 48000/48000 48000/48000

For Class 3 delay pool
delay_parameters 2 32000/32000 8000/8000 16384/16384

Example Setup:
One 512Kbps pipe line. We want to distribute the whole pipe line into 2. One for normal users and other for special users as follows
Normal users --- 128 Kbps
Special Users --- 384 Kbps

Configuration Setup File /etc/squid/squid.conf:
Before getting into the delay pools setup first create the acl(Access Control List). Through acl you can define rules according to your requirements. Find the Access Control section in the squid.conf file.
Here is an example:

acl superusers src 192.168.1.1 192.168.1.2 192.168.1.3
acl mynetwork src 192.168.1.0/255.255.255.0

Here in the above example only three users are special users who need 256Kbps bandwidth which are listed in the specialusers label and the whole network including he special users are labeled as mynetwork.

After creating the users you have to allow them to access the internet. Below line specifies for allowing the mentioned labeled users.

http_access allow superusers
http_access allow mynetwork

Now comes the funny part Delay Pools. Here We will deal with a basic example for delay pools.

The example is as follows: We are having 512Kbps pipe line connection. We want to divide it into segments one for the special users, web servers and the other for the normal users in the organization. The special users and the web servers are given 384Kbps speed and the remaining 128Kbps for the normal users.

Delay Pools for super users:
Check for the delay pools section in the squid.conf file.
Start the configuration for delay pools as follows
==================================
########## Delay Pools############
==================================

delay_pools 2

As described above we have to create 2 delay pools, one for each delay class.
====================================================
######### Defining Delay pool 1 in class 2 #########
====================================================

delay_class 1 2
delay_parameters 1 48000/48000 48000/48000
delay_access 1 allow superusers

The first line specifies Delay Class which defines delay pool 1 for the delay class 2.

Why we are using delay class 2 here?

The first part on the second line ie �1� defines the pool One(1)

The second part on second line defines the aggregate 48000/48000(restore/max). where restore is the number of bytes (not bits - modem and network speeds are usually quoted in bits) per second placed into the bucket, and maximum is the maximum number of bytes which can be in the bucket at any time.

The third part on second line is individual buckets again 48000/48000(restore/max). All the special users and the web servers should obtain the same speed of 384 Kbps.

The third line allows the super users to fall in that bucket.

=====================================================
######### Defining Delay pool 2 in class 3 #########
=====================================================

Delay Pools for normal users:

delay_class 2 3
delay_parameters 2 32000/32000 8000/8000 16384/16384
delay_access 2 allow !superusers

The first line specifies Delay Class which defines delay pool 2 for the delay class 3.

The first part on the second line ie �2� defines the pool Two(2) of class three(3)

The second part on second line defines the aggregate 32000/32000(restore/max) as aggregate (ie for whole).
Note : - If you use -1/-1. �-1� indicates �unlimited�.

The third part on second line is network bucket. We have defined here 8000/8000 .

The fourth part on second line is for individual.

The third line specifies to throttle all the users except the super users.

How to check:
First set proxy settings in your browser as follows:
Go to any client machine and open an IE(Internet Explorer). Select "Tools" menu then select "Internet Options" then select "Connections" tab. After that select the "LAN Settings" button, you will get a new pop-up window there you select "Use proxy server for your LAN" check box and finally give your squid proxy servers ip address and the port on which the squid proxy server is configured. Now press "OK" and again press "OK". Cloase the window and now open a new window.
Second Check by downloading any large file

Start to download any lage file not less than 10MB size. Because when ever you download any small file it used to download it quickly. When you start downloading large file at first if you note some starting bytes of the file gets downloaded quickly and later it gets slowed down.

Keep a note on the download pop-up box which shows the speed limits in "kbps". When we start downloading note on the pop-up box the speed limits in kbps shows high value and then slowly gets decreased. This means when you start downloading the bucket gets filled and slowly it decreases and becomes stable to the specified limit in Kbps according to the configuration. Remember again as i told restore value is used to set the download speed, and the max value lets you set the size at which the files are to be slowed down from.

on Apr 24, 2010 | fedora Linux Operating System

Tip

How to configure your squid in linux


To configure squid proxy go to
/etc/squid/squid.conf file and then change its port no. from 3128 to 8080.
this is the http port that squid proxy listen for .

Then create your own access list
acl_access name_access_list src networkaddress


Then finally u have the power to allow or deny the particular network


http_access allow name_access_list


Just follow the above three steps to let squid work properly.

You must enable ip forwarding also.

for this go to

/etc/sysctl.conf

in it on the line
net_ipv4 forwarding=0
change it to 1
this will enable the ip forwarding

you can check ip forwarding by

sysctl -p

on Apr 24, 2010 | fedora Linux Operating System

1 Answer

A good proxy software


Proxy server is for internet caching.
I suggest the following:
If your server running Linux, Squid is a good proxy software ...

If your server running Windows ISA server from Microsoft is a
good alternative.

Jan 12, 2009 | Computers & Internet

3 Answers

Obtain low bandwidh in linux


Sorry, I have no idea about Linux. Could be the software that is causing this issue..
I have forwarded this request to other Experts here who have more knowledge on this subject. Hopefully they should respond to your query within the next couple of hours..

Jun 13, 2008 | Computers & Internet

1 Answer

The size of squid log files of my proxy server are geting too big for my disk space. I manually deleate them when the disk space is gettin full & the squid service is stoped autometically.How can I delete...


Find your squid.conf file. Likely path to it could be /usr/lib/squidc/etc, or
maybe /etc/squid.

That file should contain a setting for logfile_rotate, probably at a default of
10. Change that to 2.

Then add a once-a-day job to root's crontab, on the order of:
1 1 * * * /usr/lib/squid/bin/squid -k rotate

Mar 03, 2008 | Computers & Internet

1 Answer

Squid problem


Sorry dear...you cannot configure squid for that ...since squid is a http proxy ..cannot operate it in use for smtp/pop3 connectivity ....
Cheers - Parveen

Feb 22, 2008 | Computers & Internet

1 Answer

Firewall is not configered is linux centos


try and go for it..all d best...


**********
Use yum command as follows:
# yum install squid
Output:
Loading "installonlyn" plugin Setting up Install Process Setting up repositories Reading repository metadata in from local files Parsing package install arguments Resolving Dependencies --> Populating transaction set with selected packages. Please wait. ---> Package squid.i386 7:2.6.STABLE6-4.el5 set to be updated --> Running transaction check Dependencies Resolved ============================================================================= Package Arch Version Repository Size ============================================================================= Installing: squid i386 7:2.6.STABLE6-4.el5 updates 1.2 M Transaction Summary ============================================================================= Install 1 Package(s) Update 0 Package(s) Remove 0 Package(s) Total download size: 1.2 M Is this ok [y/N]: y Downloading Packages: Running Transaction Test Finished Transaction Test Transaction Test Succeeded Running Transaction Installing: squid ######################### [1/1] Installed: squid.i386 7:2.6.STABLE6-4.el5 Complete! Squid Basic Configuration Squid configuration file located at /etc/squid/squid.conf. Open file using a text editor:
# vi /etc/squid/squid.conf
At least you need to define ACL (access control list) to work with squid. The defaults port is TCP 3128. Following example ACL allowing access from your local networks 192.168.1.0/24 and 192.168.2.0/24. Make sure you adapt to list your internal IP networks from where browsing should be allowed:
acl our_networks src 192.168.1.0/24 192.168.2.0/24
http_access allow our_networks
Save and close the file. Start squid proxy server:
# chkconfig squid on
# /etc/init.d/squid start
Output:
init_cache_dir /var/spool/squid... Starting squid: . [ OK ] Verify port 3128 is open:
# netstat -tulpn | grep 3128
Output:
tcp 0 0 0.0.0.0:3128 0.0.0.0:* LISTEN 20653/(squid) Open TCP port 3128 Finally make sure iptables is allowing to access squid proxy server. Just open /etc/sysconfig/iptables file:
# vi /etc/sysconfig/iptables
Append configuration:
-A RH-Firewall-1-INPUT -m state --state NEW,ESTABLISHED,RELATED -m tcp -p tcp --dport 3128 -j ACCEPT
Restart iptables based firewall:
# /etc/init.d/iptables restart
Output:
Flushing firewall rules: [ OK ] Setting chains to policy ACCEPT: filter [ OK ] Unloading iptables modules: [ OK ] Applying iptables firewall rules: [ OK ] Loading additional iptables modules: ip_conntrack_netbios_n[ OK ] Client configuration Open a webbrowser > Tools > Internet option > Network settings > and setup Squid server IP address and port # 3128.
See also You may find our previous squid tips useful:

Nov 26, 2007 | Computers & Internet

2 Answers

All Public IPs


In order to use your DFL-200 as a firewall, and not a router, you will need to put it into "transparent mode." This will allow you to use only public IP addresses and you will not be using NAT.

Jun 20, 2007 | D-Link NetDefend DFL-200 Firewall

Not finding what you are looking for?
Computers & Internet Logo

Related Topics:

399 people viewed this question

Ask a Question

Usually answered in minutes!

Top Computers & Internet Experts

Doctor PC
Doctor PC

Level 3 Expert

7733 Answers

kakima

Level 3 Expert

102366 Answers

David Payne
David Payne

Level 3 Expert

14161 Answers

Are you a Computer and Internet Expert? Answer questions, earn points and help others

Answer questions

Manuals & User Guides

Loading...