Re: [squid-users] Transparent Proxy on OpenBSD 5.3 with Squid 3.2.7

[Marc Sontowski]

On Mon, Nov 04, 2013 at 04:33:29PM +0100, Marko Cupać wrote:

On Mon, 4 Nov 2013 16:05:38 +0100
Marc Sontowski <m...@sontowski.net> wrote:

                # Pass all traffic to and from the local network, using quick 
so that later
                # rules are not evaluated if a packet match this. Some rulesets 
would restrict
                # local traffic much further
                pass quick on $int_if all

As comment says, quick keyword makes later rules being not evaluated if
a packet match this. Try to add:        

                pass in quick on $ext_if proto tcp from 192.168.2.0/24 to port 
www divert-to 127.0.0.1 port 3128

above line that passes all quick on $int_if.

--
Marko Cupać

Thanks Marko!
my /etc/pf.conf looks like that now:

---
# The internal interface (connected to the local network)
ext_if="em0"
# The external interfaces (connected to the ipv4 and ipv6 network)
int_if="em1"


## Options
set loginterface $ext_if
set optimization aggressive

# scrub incomming packets
match on egress scrub  (no-df)

# Set the default policy to return RSTs or ICMPs for blocked traffic
set block-policy drop

# Ignore the loopback interface entirely
set skip on lo0

anchor "ftp-proxy/*"

pass in quick on $int_if inet proto tcp to any port ftp \
divert-to 127.0.0.1 port 8021

## Translation rules

# NAT traffic on the interface in the default egress interface group (to
# which the interface out of which the default route goes is assigned) from the
# local network
match out on egress inet from $int_if:network to any nat-to (egress)

## Filtering rules

# Default deny rule. which all blocked packets logged.
block log all
block in log on $ext_if all
antispoof log for egress


#squid transparent
pass in quick on $ext_if proto tcp from 192.168.2.0/24 to port www divert-to 
127.0.0.1 port 3128
pass out quick from 127.0.0.1 divert-reply


# Pass all traffic to and from the local network, using quick so that later
# rules are not evaluated if a packet match this. Some rulesets would restrict
# local traffic much further
pass out quick
---

But it doesn't work :-(



--
Marc Sontowski

pgpzHgUWOL5qO.pgp
Description: PGP signature