On Sun, Oct 4, 2020 at 7:58 PM Tom Eastep <teas...@shorewall.net> wrote: > > On 10/2/20 4:19 AM, Vieri Di Paola wrote: > > Hi, > > > > I have some clients in a LAN that require access to WAN through a > > transparent Squid web proxy on FW. > > > > I have this in mangle: > > > > # METHOD 1: > > DIVERT $IF_WAN $PROXY_SOURCE_WAN > > tcp - 80 > > TPROXY(3129) ${IF_LAN}:$PROXY_SOURCE_WAN $PROXY_DESTINATION_WAN > > tcp 80 > > TPROXY(3129) ${IF_LAN}.1:$PROXY_SOURCE_WAN $PROXY_DESTINATION_WAN > > tcp 80 > > TPROXY(3129) ${IF_LAN}.12:$PROXY_SOURCE_WAN $PROXY_DESTINATION_WAN > > tcp 80 > > TPROXY(3129) ${IF_LAN}.13:$PROXY_SOURCE_WAN $PROXY_DESTINATION_WAN > > tcp 80 > > TPROXY(3129) ${IF_LAN}.14:$PROXY_SOURCE_WAN $PROXY_DESTINATION_WAN > > tcp 80 > > TPROXY(3129) ${IF_LAN}.15:$PROXY_SOURCE_WAN $PROXY_DESTINATION_WAN > > tcp 80 > > TPROXY(3129) ${IF_LAN}.16:$PROXY_SOURCE_WAN $PROXY_DESTINATION_WAN > > tcp 80 > > TPROXY(3129) ${IF_LAN}.17:$PROXY_SOURCE_WAN $PROXY_DESTINATION_WAN > > tcp 80 > > DIVERT $IF_WAN $PROXY_SOURCE_WAN > > tcp - 443 > > TPROXY(3130) ${IF_LAN}:$PROXY_SOURCE_WAN $PROXY_DESTINATION_WAN > > tcp 443 > > TPROXY(3130) ${IF_LAN}.1:$PROXY_SOURCE_WAN $PROXY_DESTINATION_WAN > > tcp 443 > > TPROXY(3130) ${IF_LAN}.12:$PROXY_SOURCE_WAN $PROXY_DESTINATION_WAN > > tcp 443 > > TPROXY(3130) ${IF_LAN}.13:$PROXY_SOURCE_WAN $PROXY_DESTINATION_WAN > > tcp 443 > > TPROXY(3130) ${IF_LAN}.14:$PROXY_SOURCE_WAN $PROXY_DESTINATION_WAN > > tcp 443 > > TPROXY(3130) ${IF_LAN}.15:$PROXY_SOURCE_WAN $PROXY_DESTINATION_WAN > > tcp 443 > > TPROXY(3130) ${IF_LAN}.16:$PROXY_SOURCE_WAN $PROXY_DESTINATION_WAN > > tcp 443 > > TPROXY(3130) ${IF_LAN}.17:$PROXY_SOURCE_WAN $PROXY_DESTINATION_WAN > > tcp 443 > > ## non-standard port > > DIVERT $IF_WAN $PROXY_SOURCE_WAN > > tcp - 8886 > > TPROXY(3130) ${IF_LAN}:$PROXY_SOURCE_WAN $PROXY_DESTINATION_WAN > > tcp 8886 > > TPROXY(3130) ${IF_LAN}.1:$PROXY_SOURCE_WAN $PROXY_DESTINATION_WAN > > tcp 8886 > > TPROXY(3130) ${IF_LAN}.12:$PROXY_SOURCE_WAN $PROXY_DESTINATION_WAN > > tcp 8886 > > TPROXY(3130) ${IF_LAN}.13:$PROXY_SOURCE_WAN $PROXY_DESTINATION_WAN > > tcp 8886 > > TPROXY(3130) ${IF_LAN}.14:$PROXY_SOURCE_WAN $PROXY_DESTINATION_WAN > > tcp 8886 > > TPROXY(3130) ${IF_LAN}.15:$PROXY_SOURCE_WAN $PROXY_DESTINATION_WAN > > tcp 8886 > > TPROXY(3130) ${IF_LAN}.16:$PROXY_SOURCE_WAN $PROXY_DESTINATION_WAN > > tcp 8886 > > TPROXY(3130) ${IF_LAN}.17:$PROXY_SOURCE_WAN $PROXY_DESTINATION_WAN > > tcp 8886 > > > > I am also required to add an ACCEPT rule from LAN* to FW for ports tcp > > 80,443,8886. > > Finally, I also need to set SSL_ports and Safe_ports in squid conf to > > include 8886 which is non-standard. > > > > So, METHOD 1 seems to work. > > I seriously doubt that the TLS handshake works when you try using HTTPS. > The proxy is a 'man in the middle' in that case. > > > > > However, using a list of port numbers, ranges or ipsets does not seem to > > work. > > > > For instance, the following in mangle does not work as expected. > > > > # METHOD 2 > > DIVERT $IF_WAN $PROXY_SOURCE_WAN > > tcp - 80,443,8886 > > TPROXY(3129) ${IF_LAN}:$PROXY_SOURCE_WAN $PROXY_DESTINATION_WAN > > tcp 80,443,8886 > > TPROXY(3129) ${IF_LAN}.1:$PROXY_SOURCE_WAN $PROXY_DESTINATION_WAN > > tcp 80,443,8886 > > TPROXY(3129) ${IF_LAN}.12:$PROXY_SOURCE_WAN $PROXY_DESTINATION_WAN > > tcp 80,443,8886 > > TPROXY(3129) ${IF_LAN}.13:$PROXY_SOURCE_WAN $PROXY_DESTINATION_WAN > > tcp 80,443,8886 > > TPROXY(3129) ${IF_LAN}.14:$PROXY_SOURCE_WAN $PROXY_DESTINATION_WAN > > tcp 80,443,8886 > > TPROXY(3129) ${IF_LAN}.15:$PROXY_SOURCE_WAN $PROXY_DESTINATION_WAN > > tcp 80,443,8886 > > TPROXY(3129) ${IF_LAN}.16:$PROXY_SOURCE_WAN $PROXY_DESTINATION_WAN > > tcp 80,443,8886 > > TPROXY(3129) ${IF_LAN}.17:$PROXY_SOURCE_WAN $PROXY_DESTINATION_WAN > > tcp 80,443,8886 > > > > Is there a reason why METHOD 2 is apparently wrong? > > > > What would be more helpful would be an explanation of 'does not work as > expected'.
With METHOD 1 in Squid I get messages such as these in the log: NONE/200 0 CONNECT w.x.y.z:443 TCP_MISS/200 5786 GET https://domain.org With METHOD 2 in Squid I get this instead: NONE/000 0 NONE error:invalid-request - HIER_NONE/- - TCP_TUNNEL/200 8740 NONE w.x.y.z:443 This might be a question for the Squid mailing list, but I'm asking it here because I am getting two different behaviors when changing only SW's configuration. Vieri _______________________________________________ Shorewall-users mailing list Shorewall-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/shorewall-users