Talk:Transparent web proxy

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 22:23, 28 December 2005 (edit)
72.56.40.206 (Talk)

← Previous diff
Current revision (14:08, 16 May 2010) (edit) (undo)
Glenn (Talk | contribs)
m (Talk:Transparent Proxy moved to Talk:Transparent web proxy)
 
(19 intermediate revisions not shown.)
Line 1: Line 1:
-Sure the script will not work with the PASTE EDITED SCRIPT HERE portion because of the double quotes....+Has anyone done this last step successfully?
 +http://wrt-wiki.bsr-clan.de/index.php?title=Squid_Transparent_Proxy
-The first lines would look like this:+I'm trying to get the script to start whenever the router boots, but after pasting in the script, I can never return to the ~ # prompt that would enable me to enter the nvram commit command.
-nvram rc_firewall="+
- #!/bin/sh+
- INTERNAL_NETWORK="192.168.0.0/24"+
- ROUTER_IP="192.168.0.1"+
- ....+
-"+
-which would read like:+doesn't work
-nvram rc_firewall="\n#!/bin/sh\nINTERNAL_NETWORK="+
-Shouldn't the "'s be replaced with ' where possible? I submit that is should be:+iptables -t nat -A POSTROUTING -o br0 -s 192.168.178.0/24 -p tcp -d 192.168.178.11 -j SNAT --to-source 192.168.178.10
 + 
 +iptables v1.3.3: Unknown arg `--to-source'
 + 
 + 
 + 
 +iptables -t nat -A POSTROUTING -o br0 -s 192.168.178.0/24 -p tcp -d 192.168.178.11 -j SNAT --to 192.168.178.10
 +iptables v1.3.3: Unknown arg `--to'
 + 
 +Try `iptables -h' or 'iptables --help' for more information.
 + 
 +i've got it working, but a few modifications were necessary for my setup using the vpn flavor of dd-wrt v24 rc6.2 on an asus wl500g premium.
 + 
 +== rc_firewall script ==
 + 
 +i changed the rc_firewall script to this:
 +<pre>
#!/bin/sh #!/bin/sh
-INTERNAL_NETWORK='192.168.0.0/24'+PROXY_SERVER="192.168.2.7"
-ROUTER_IP='192.168.0.1'+
-PROXY_SERVER='192.168.0.10'+
-PROXY_PORT='3128'+
if [ -z $TRANSPARENT_PROXY ]; then if [ -z $TRANSPARENT_PROXY ]; then
- /usr/sbin/iptables -t nat -A PREROUTING -i br0 -s $INTERNAL_NETWORK \+ /usr/sbin/iptables -t mangle -A PREROUTING -j ACCEPT -p tcp --dport 80 -s $PROXY_SERVER
- -d $INTERNAL_NETWORK -p tcp --dport 80 -j ACCEPT+ /usr/sbin/iptables -t mangle -A PREROUTING -j MARK --set-mark 3 -p tcp --dport 80
- /usr/sbin/iptables -t nat -A PREROUTING -i br0 -s ! $PROXY_SERVER -p tcp --dport 80 \+ /usr/sbin/ip rule add fwmark 3 table 2
- -j DNAT --to $PROXY_SERVER:$PROXY_PORT+ /usr/sbin/ip route add default via $PROXY_SERVER dev br0 table 2
- /usr/sbin/iptables -t nat -A POSTROUTING -o br0 -s $INTERNAL_NETWORK -p tcp -d \+
- $PROXY_SERVER -j SNAT --to $ROUTER_IP+
- /usr/sbin/iptables -t filter -I FORWARD -s $INTERNAL_NETWORK -d $PROXY_SERVER -i br0 \+
- -o br0 -p tcp --dport $PROXY_PORT -j ACCEPT+
export TRANSPARENT_PROXY=1 export TRANSPARENT_PROXY=1
else else
- echo 'This script has already run!'+ echo "This transparent proxy script stored in nvram rc_firewall has already run!"
- echo 'If it has not, unset \$TRANSPARENT_PROXY manually via the shell.'+ echo "If it hasnt, unset \$TRANSPARENT_PROXY manually via the shell."
fi fi
 +</pre>
 +
 +== installing the script to nvram ==
 +
 +i saved that script to a file named <code>command.txt</code> on my desktop pc and transferred it to the router using the scp command:<br>
 +<code>scp command.txt root@192.168.2.1:/tmp/root/</code><br>
 +
 +then i connected to the router using ssh:<br>
 +<code>ssh root@192.168.2.1</code><br>
 +and used the following commands to install the transparent proxy:<br>
 +<code>nvram set rc_firewall="$(cat /tmp/root/command.txt)"; nvram commit; nvram get rc_firewall</code><br>
 +
 +[[User:Sed|Sed]] 23:19, 26 February 2008 (CET)
 +
 +== iptables on the squid server ==
 +on the squid server, i'm using this iptables command redirect http requests to the squid port, i'm using port 3129 for the transparent proxy, so the iptables setup looks like this:
 +<pre>
 +iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3129
 +</pre>
 +on my linux distribution, that rule is saved and set at boot time via the <code>/etc/init.d/iptables</code> init script.
--GIN+you can verify that the iptables rule is in-place by typing:<br><code>iptables -t nat -L PREROUTING -v</code>

Current revision

Has anyone done this last step successfully? http://wrt-wiki.bsr-clan.de/index.php?title=Squid_Transparent_Proxy

I'm trying to get the script to start whenever the router boots, but after pasting in the script, I can never return to the ~ # prompt that would enable me to enter the nvram commit command.

doesn't work

iptables -t nat -A POSTROUTING -o br0 -s 192.168.178.0/24 -p tcp -d 192.168.178.11 -j SNAT --to-source 192.168.178.10

iptables v1.3.3: Unknown arg `--to-source'


iptables -t nat -A POSTROUTING -o br0 -s 192.168.178.0/24 -p tcp -d 192.168.178.11 -j SNAT --to 192.168.178.10 iptables v1.3.3: Unknown arg `--to'

Try `iptables -h' or 'iptables --help' for more information.

i've got it working, but a few modifications were necessary for my setup using the vpn flavor of dd-wrt v24 rc6.2 on an asus wl500g premium.

[edit] rc_firewall script

i changed the rc_firewall script to this:

#!/bin/sh
PROXY_SERVER="192.168.2.7"
if [ -z $TRANSPARENT_PROXY ]; then
  /usr/sbin/iptables -t mangle -A PREROUTING -j ACCEPT -p tcp --dport 80 -s $PROXY_SERVER
  /usr/sbin/iptables -t mangle -A PREROUTING -j MARK --set-mark 3 -p tcp --dport 80
  /usr/sbin/ip rule add fwmark 3 table 2
  /usr/sbin/ip route add default via $PROXY_SERVER dev br0 table 2
  export TRANSPARENT_PROXY=1
else
  echo "This transparent proxy script stored in nvram rc_firewall has already run!"
  echo "If it hasnt, unset \$TRANSPARENT_PROXY manually via the shell."
fi

[edit] installing the script to nvram

i saved that script to a file named command.txt on my desktop pc and transferred it to the router using the scp command:
scp command.txt root@192.168.2.1:/tmp/root/

then i connected to the router using ssh:
ssh root@192.168.2.1
and used the following commands to install the transparent proxy:
nvram set rc_firewall="$(cat /tmp/root/command.txt)"; nvram commit; nvram get rc_firewall

Sed 23:19, 26 February 2008 (CET)

[edit] iptables on the squid server

on the squid server, i'm using this iptables command redirect http requests to the squid port, i'm using port 3129 for the transparent proxy, so the iptables setup looks like this:

iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3129

on my linux distribution, that rule is saved and set at boot time via the /etc/init.d/iptables init script.

you can verify that the iptables rule is in-place by typing:
iptables -t nat -L PREROUTING -v