Talk:Transparent web proxy
From DD-WRT Wiki
Revision as of 22:24, 28 December 2005 (edit) 72.56.40.206 (Talk) ← Previous diff |
Current revision (14:08, 16 May 2010) (edit) (undo) Glenn (Talk | contribs) m (Talk:Transparent Proxy moved to Talk:Transparent web proxy) |
||
(18 intermediate revisions not shown.) | |||
Line 1: | Line 1: | ||
+ | Has anyone done this last step successfully? | ||
+ | http://wrt-wiki.bsr-clan.de/index.php?title=Squid_Transparent_Proxy | ||
+ | I'm trying to get the script to start whenever the router boots, but after pasting in the script, I can never return to the ~ # prompt that would enable me to enter the nvram commit command. | ||
+ | |||
+ | doesn't work | ||
+ | |||
+ | iptables -t nat -A POSTROUTING -o br0 -s 192.168.178.0/24 -p tcp -d 192.168.178.11 -j SNAT --to-source 192.168.178.10 | ||
+ | |||
+ | iptables v1.3.3: Unknown arg `--to-source' | ||
+ | |||
+ | |||
+ | |||
+ | iptables -t nat -A POSTROUTING -o br0 -s 192.168.178.0/24 -p tcp -d 192.168.178.11 -j SNAT --to 192.168.178.10 | ||
+ | iptables v1.3.3: Unknown arg `--to' | ||
+ | |||
+ | Try `iptables -h' or 'iptables --help' for more information. | ||
+ | |||
+ | i've got it working, but a few modifications were necessary for my setup using the vpn flavor of dd-wrt v24 rc6.2 on an asus wl500g premium. | ||
+ | |||
+ | == rc_firewall script == | ||
+ | |||
+ | i changed the rc_firewall script to this: | ||
+ | <pre> | ||
+ | #!/bin/sh | ||
+ | PROXY_SERVER="192.168.2.7" | ||
+ | if [ -z $TRANSPARENT_PROXY ]; then | ||
+ | /usr/sbin/iptables -t mangle -A PREROUTING -j ACCEPT -p tcp --dport 80 -s $PROXY_SERVER | ||
+ | /usr/sbin/iptables -t mangle -A PREROUTING -j MARK --set-mark 3 -p tcp --dport 80 | ||
+ | /usr/sbin/ip rule add fwmark 3 table 2 | ||
+ | /usr/sbin/ip route add default via $PROXY_SERVER dev br0 table 2 | ||
+ | export TRANSPARENT_PROXY=1 | ||
+ | else | ||
+ | echo "This transparent proxy script stored in nvram rc_firewall has already run!" | ||
+ | echo "If it hasnt, unset \$TRANSPARENT_PROXY manually via the shell." | ||
+ | fi | ||
+ | </pre> | ||
+ | |||
+ | == installing the script to nvram == | ||
+ | |||
+ | i saved that script to a file named <code>command.txt</code> on my desktop pc and transferred it to the router using the scp command:<br> | ||
+ | <code>scp command.txt root@192.168.2.1:/tmp/root/</code><br> | ||
+ | |||
+ | then i connected to the router using ssh:<br> | ||
+ | <code>ssh root@192.168.2.1</code><br> | ||
+ | and used the following commands to install the transparent proxy:<br> | ||
+ | <code>nvram set rc_firewall="$(cat /tmp/root/command.txt)"; nvram commit; nvram get rc_firewall</code><br> | ||
+ | |||
+ | [[User:Sed|Sed]] 23:19, 26 February 2008 (CET) | ||
+ | |||
+ | == iptables on the squid server == | ||
+ | |||
+ | on the squid server, i'm using this iptables command redirect http requests to the squid port, i'm using port 3129 for the transparent proxy, so the iptables setup looks like this: | ||
+ | <pre> | ||
+ | iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3129 | ||
+ | </pre> | ||
+ | |||
+ | on my linux distribution, that rule is saved and set at boot time via the <code>/etc/init.d/iptables</code> init script. | ||
+ | |||
+ | you can verify that the iptables rule is in-place by typing:<br><code>iptables -t nat -L PREROUTING -v</code> |
Current revision
Has anyone done this last step successfully? http://wrt-wiki.bsr-clan.de/index.php?title=Squid_Transparent_Proxy
I'm trying to get the script to start whenever the router boots, but after pasting in the script, I can never return to the ~ # prompt that would enable me to enter the nvram commit command.
doesn't work
iptables -t nat -A POSTROUTING -o br0 -s 192.168.178.0/24 -p tcp -d 192.168.178.11 -j SNAT --to-source 192.168.178.10
iptables v1.3.3: Unknown arg `--to-source'
iptables -t nat -A POSTROUTING -o br0 -s 192.168.178.0/24 -p tcp -d 192.168.178.11 -j SNAT --to 192.168.178.10 iptables v1.3.3: Unknown arg `--to'
Try `iptables -h' or 'iptables --help' for more information.
i've got it working, but a few modifications were necessary for my setup using the vpn flavor of dd-wrt v24 rc6.2 on an asus wl500g premium.
[edit] rc_firewall script
i changed the rc_firewall script to this:
#!/bin/sh PROXY_SERVER="192.168.2.7" if [ -z $TRANSPARENT_PROXY ]; then /usr/sbin/iptables -t mangle -A PREROUTING -j ACCEPT -p tcp --dport 80 -s $PROXY_SERVER /usr/sbin/iptables -t mangle -A PREROUTING -j MARK --set-mark 3 -p tcp --dport 80 /usr/sbin/ip rule add fwmark 3 table 2 /usr/sbin/ip route add default via $PROXY_SERVER dev br0 table 2 export TRANSPARENT_PROXY=1 else echo "This transparent proxy script stored in nvram rc_firewall has already run!" echo "If it hasnt, unset \$TRANSPARENT_PROXY manually via the shell." fi
[edit] installing the script to nvram
i saved that script to a file named command.txt
on my desktop pc and transferred it to the router using the scp command:
scp command.txt root@192.168.2.1:/tmp/root/
then i connected to the router using ssh:
ssh root@192.168.2.1
and used the following commands to install the transparent proxy:
nvram set rc_firewall="$(cat /tmp/root/command.txt)"; nvram commit; nvram get rc_firewall
Sed 23:19, 26 February 2008 (CET)
[edit] iptables on the squid server
on the squid server, i'm using this iptables command redirect http requests to the squid port, i'm using port 3129 for the transparent proxy, so the iptables setup looks like this:
iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3129
on my linux distribution, that rule is saved and set at boot time via the /etc/init.d/iptables
init script.
you can verify that the iptables rule is in-place by typing:iptables -t nat -L PREROUTING -v