I have now made some changes based on suggestions from the community and
would like a second look from the more experienced people.
Here is my squid configuration file:
----------------
visible_hostname ctct-r2
# 2) Initialize SSL database first
sslcrtd_program /usr/libexec/ssl_crtd -s /var/lib/ssl_db -M 4MB
# 3) An ACL named 'whitelist'
acl whitelist dstdomain '/etc/squid/whitelist.ota'
# 4) Allow whitelisted URLs through
http_access allow whitelist
# 5) Listen to incoming HTTP traffic
http_port 3128
# 6) Block the rest
http_access deny all
# 7) Listen for incoming HTTPS traffic and intercept it
https_port 3129 intercept ssl-bump cert=/etc/squid/ssl_cert/myCA.pem
generate-host-certificates=on dynamic_cert_mem_cache_size=4MB
# 8) Pass the SSL (HTTPS) traffic transparently through
ssl_bump splice all
# 9) Send out all HTTPS traffic to destination server via given IP address
tcp_outgoing_address 10.3.19.150
-------------------
And here are the iptables' settings:
NAT table:
# iptables -nvL -t nat
Chain PREROUTING (policy ACCEPT 9094 packets, 1823K bytes)
pkts bytes target prot opt in out source
destination
0 0 ACCEPT tcp -- * * 10.3.19.150
0.0.0.0/0 tcp dpt:80
0 0 ACCEPT tcp -- * * 10.3.19.150
0.0.0.0/0 tcp dpt:443
0 0 REDIRECT tcp -- eth0 * 0.0.0.0/0
0.0.0.0/0 tcp dpt:443 redir ports 3129
0 0 REDIRECT tcp -- eth0 * 0.0.0.0/0
0.0.0.0/0 tcp dpt:80 redir ports 3128
Chain INPUT (policy ACCEPT 1 packets, 70 bytes)
pkts bytes target prot opt in out source
destination
Chain OUTPUT (policy ACCEPT 9 packets, 627 bytes)
pkts bytes target prot opt in out source
destination
Chain POSTROUTING (policy ACCEPT 9 packets, 627 bytes)
pkts bytes target prot opt in out source
destination
0 0 MASQUERADE all -- * eth1 192.168.168.0/24
0.0.0.0/0
0 0 MASQUERADE all -- * eth1 192.168.192.0/24
0.0.0.0/0
0 0 MASQUERADE all -- * wlan0 192.168.168.0/24
0.0.0.0/0
0 0 MASQUERADE all -- * wlan0 192.168.192.0/24
0.0.0.0/0
------------------------------
Mangle table:
# iptables -nvL -t mangle
Chain PREROUTING (policy ACCEPT 12117 packets, 2382K bytes)
pkts bytes target prot opt in out source
destination
16 960 DROP tcp -- * * 0.0.0.0/0
0.0.0.0/0 tcp dpt:443
Chain INPUT (policy ACCEPT 11861 packets, 2319K bytes)
pkts bytes target prot opt in out source
destination
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
Chain OUTPUT (policy ACCEPT 451 packets, 47694 bytes)
pkts bytes target prot opt in out source
destination
Chain POSTROUTING (policy ACCEPT 451 packets, 47694 bytes)
pkts bytes target prot opt in out source
destination
-----------------------------
Routing table:
# iptables -nvL
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
3843 304K ACCEPT all -- * * 0.0.0.0/0
0.0.0.0/0 ctstate RELATED,ESTABLISHED
1 59 ACCEPT icmp -- * * 0.0.0.0/0
0.0.0.0/0 icmptype 8 ctstate NEW
33 2285 ACCEPT all -- lo * 0.0.0.0/0
0.0.0.0/0
0 0 DROP all -- * * 0.0.0.0/0
0.0.0.0/0 ctstate INVALID
91160 17M APP_RULES all -- * * 0.0.0.0/0
0.0.0.0/0 ctstate NEW
91160 17M OS_RULES all -- * * 0.0.0.0/0
0.0.0.0/0 ctstate NEW
15 3195 REJECT udp -- * * 0.0.0.0/0
0.0.0.0/0 reject-with icmp-port-unreachable
75 4508 REJECT tcp -- * * 0.0.0.0/0
0.0.0.0/0 reject-with tcp-reset
0 0 REJECT all -- * * 0.0.0.0/0
0.0.0.0/0 reject-with icmp-proto-unreachable
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
0 0 ACCEPT all -- * * 0.0.0.0/0
0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT all -- wlan1 wlan1 0.0.0.0/0
0.0.0.0/0
7 739 REJECT all -- * * 0.0.0.0/0
0.0.0.0/0 reject-with icmp-host-unreachable
Chain OUTPUT (policy ACCEPT 523 packets, 54506 bytes)
pkts bytes target prot opt in out source
destination
0 0 ACCEPT tcp -- * eth1 10.3.19.150
0.0.0.0/0 <<<--------------
Chain APP_RULES (1 references)
pkts bytes target prot opt in out source
destination
0 0 ACCEPT tcp -- eth1 * 0.0.0.0/0
0.0.0.0/0 tcp dpt:20
0 0 ACCEPT tcp -- eth1 * 0.0.0.0/0
0.0.0.0/0 tcp dpt:21
0 0 ACCEPT tcp -- eth1 * 0.0.0.0/0
0.0.0.0/0 tcp dpt:80
Chain DEV_RULES (2 references)
pkts bytes target prot opt in out source
destination
6 360 ACCEPT tcp -- * * 0.0.0.0/0
0.0.0.0/0 tcp dpt:22
0 0 ACCEPT tcp -- * * 0.0.0.0/0
0.0.0.0/0 tcp dpt:1534
0 0 ACCEPT tcp -- * * 0.0.0.0/0
0.0.0.0/0 tcp dpt:2345
0 0 ACCEPT udp -- * * 0.0.0.0/0
0.0.0.0/0 udp dpt:1534
0 0 ACCEPT udp -- * * 0.0.0.0/0
0.0.0.0/0 udp dpt:2345
Chain EXTERNAL_RULES (2 references)
pkts bytes target prot opt in out source
destination
90961 17M DROP all -- * * 0.0.0.0/0
0.0.0.0/0
Chain INTERNAL_RULES (2 references)
pkts bytes target prot opt in out source
destination
95 5676 ACCEPT udp -- * * 0.0.0.0/0
0.0.0.0/0 udp dpt:53
5 1592 ACCEPT udp -- * * 0.0.0.0/0
0.0.0.0/0 udp dpt:67
1 328 ACCEPT udp -- * * 0.0.0.0/0
0.0.0.0/0 udp dpt:68
2 120 ACCEPT tcp -- * * 0.0.0.0/0
0.0.0.0/0 tcp dpt:80
Chain OS_RULES (1 references)
pkts bytes target prot opt in out source
destination
199 15779 DEV_RULES all -- eth0 * 0.0.0.0/0
0.0.0.0/0
0 0 DEV_RULES all -- wlan1 * 0.0.0.0/0
0.0.0.0/0
193 15419 INTERNAL_RULES all -- eth0 * 0.0.0.0/0
0.0.0.0/0
0 0 INTERNAL_RULES all -- wlan1 * 0.0.0.0/0
0.0.0.0/0
90961 17M EXTERNAL_RULES all -- eth1 * 0.0.0.0/0
0.0.0.0/0
0 0 EXTERNAL_RULES all -- wlan0 * 0.0.0.0/0
0.0.0.0/0
------------------------------------------------
I am now getting something related to my testing expectation but there
problems
like following:
```
15:05:58.464105 IP (tos 0x0, ttl 64, id 33640, offset 0, flags [DF], proto
UDP (17), length 70)
10.3.19.150.55834 > 10.3.30.20.domain: [udp sum ok] 31312+ A?
api.globalota.limios.net. (42)
....
15:05:58.810877 IP (tos 0xc0, ttl 64, id 32951, offset 0, flags [none],
proto ICMP (1), length 209)
10.3.19.150 > 10.3.0.124: ICMP 10.3.19.150 udp port 55834 unreachable,
length 189
------------------------------------- Any hint would be appreciated
--------------------
Also, there is a configuration in the chain OUTPUT policy marked with the
"<<<-------------" string above,
which I am not sure about.
Cheers,
Buda
--
11-17 Birmingham Drive, Christchurch, Canterbury, 8024
New Zealand
+64 3 963-5550 Direct
+64 21 419-024 Mobile
www.trimble.com
This email may contain confidential information that is intended only for
the listed recipient(s) of this email. Any unauthorized review, use,
disclosure or distribution is prohibited. If you believe you have received
this email in error, please immediately delete this email and any
attachments, and inform me via reply email.
_______________________________________________
squid-users mailing list
squid-users@lists.squid-cache.org
https://lists.squid-cache.org/listinfo/squid-users
