nixCraft

Hi ,

I need to configure squid for a tranparent proxy ...i have implement this settings in my squid.conf .

/etc/squid/squid.conf

cache_access_log /var/log/squid/access.log
cache_log /var/log/squid/cache.log

acl abc_network src 192.168.111.0/24
acl all src 0.0.0.0/0.0.0.0

http_access allow abc_network

httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_uses_host_header on

also implement this in my iptables ..

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to 192.168.111.116:3128
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128

iptables -L

[root@testnut squid]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere

Chain FORWARD (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain RH-Firewall-1-INPUT (2 reference
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere icmp any
ACCEPT esp -- anywhere anywhere
ACCEPT ah -- anywhere anywhere
ACCEPT udp -- anywhere 224.0.0.251 udp dpt:mdns
ACCEPT udp -- anywhere anywhere udp dpt:ipp
ACCEPT tcp -- anywhere anywhere tcp dpt:ipp
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ftp
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:smtp
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:nfs
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh
ACCEPT udp -- anywhere anywhere state NEW udp dpt:netbios-ns
ACCEPT udp -- anywhere anywhere state NEW udp dpt:netbios-dgm
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:netbios-ssn
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:microsoft-ds
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:https
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:telnet
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:http
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited

i have choose this configuration guid from this site

Linux: Setup a transparent proxy with Squid in three easy steps

but when i am trying to retart squid it fails ..

Stopping squid: /etc/init.d/squid: line 82: 25723 Aborted $SQUID -k check >>/var/log/squid/squid.out 2>&1
[FAILED]
init_cache_dir /var/spool/squid... /etc/init.d/squid: line 54: 25724 Aborted $SQUID -z -F -D >>/var/log/squid/squid.out 2>&1
Starting squid: /etc/init.d/squid: line 53: 25725 Aborted $SQUID $SQUID_OPTS >>/var/log/squid/squid.out 2>&1
[FAILED]

Out put for squid.out

Squid Cache (Version 2.6.STABLE6): Terminated abnormally.
CPU Usage: 0.008 seconds = 0.008 user + 0.000 sys
Maximum Resident Size: 0 KB
Page faults with physical i/o: 0
2008/04/12 16:19:22| parseConfigFile: line 9 unrecognized: 'httpd port 3128'
2008/04/12 16:19:22| parseConfigFile: line 10 unrecognized: 'httpd_accel_host virtual'
2008/04/12 16:19:22| parseConfigFile: line 11 unrecognized: 'httpd_accel_port 80'
2008/04/12 16:19:22| parseConfigFile: line 12 unrecognized: 'httpd_accel_with_proxy on'
2008/04/12 16:19:22| parseConfigFile: line 13 unrecognized: 'httpd_accel_uses_host_header on '
FATAL: No port defined

can any one help me ..when the settings are wrong ...

Thanks in advance ...

John

parseConfigFile: line 9 unrecognized: 'httpd port 3128'

should be

Check your squid version if it is squid 2.6 you need to putt http_port 3128 transparent and http_port 80 vhost. I encounter same problem as your's

remove the ff:
httpd_accel_host virtual'
'httpd_accel_port 80'
ttpd_accel_with_proxy on'
'httpd_accel_uses_host_header on '

replace with
http_port 3128 transparent
http_port 80 vhost

im facing so much difficulty to create a transparent proxy in my rhel server.
i have enabled the routing from my server with the following iptable rule:
iptables -t nat -A POSTROUTING -j SNAT --to-source 203.83.188.138

but i cant act squid as transparent
note that i have made changes in the following lines
http_port 3128 transparent
http_port 80 vhost
and insert a acl too.

pls help me if any?

__________________
Vivek | My personal blog
Linux Evangelist
Play hard stay cool