title: squid transparent proxy (intercept) + router
body: <p>there is already a configured transparent proxy squid-3.5.27, there is an EdgeOSEdgeRouter router</p>
  
  <p>I want to make a circuit</p>
  
  <p>all computers on the network -> router -> squid</p>
  
  <p>squid - 109.0.0.110
  router - 109.0.0.1
  test Windows - 109.0.0.8</p>
  
  <p>configuration squid.conf, version - squid-3.5.27</p>
  
  <pre><code># You should use the same dns resolver on squid and all clients
  dns_nameservers 127.0.0.1
  
  # acls
  acl localnet src 109.0.0.0/24        # RFC1918 possible internal network
  acl localnet src 192.168.1.0/24 # RFC1918 possible internal network
  acl localnet src 192.168.10.0/24        # RFC1918 possible internal network
  
  acl SSL_ports port 443
  acl Safe_ports port 80          # http
  acl Safe_ports port 21          # ftp
  acl Safe_ports port 443         # https
  acl Safe_ports port 70          # gopher
  acl Safe_ports port 210         # wais
  acl Safe_ports port 1025-65535  # unregistered ports
  acl Safe_ports port 280         # http-mgmt
  acl Safe_ports port 488         # gss-http
  acl Safe_ports port 591         # filemaker
  acl Safe_ports port 777         # multiling http
  acl CONNECT method CONNECT
  
  acl blocked_http dstdomain "/etc/squid/blocked_sites.txt"
  
  # http access
  http_access deny !Safe_ports
  
  http_access deny CONNECT !SSL_ports
  
  http_access allow localhost manager
  http_access deny manager
  
  http_access deny blocked_http
  
  http_access allow localnet
  http_access allow localhost
  http_access deny all
  
  http_port 3128 intercept
  https_port 3129 intercept  ssl-bump connection-auth=off cert=/etc/squid/squidCA.pem
  http_port 3130
  
  always_direct allow all
  sslproxy_cert_error allow all
  sslproxy_flags DONT_VERIFY_PEER
  
  acl blocked ssl::server_name "/etc/squid/blocked_https.txt"
  acl whitelist src "/etc/squid/whitelist_ip.txt"
  ssl_bump splice whitelist
  acl step1 at_step SslBump1
  ssl_bump peek step1
  
  ssl_bump terminate blocked
  ssl_bump splice all
  
  sslcrtd_program /opt/source/squid-3.5.27/src/ssl/ssl_crtd -s /var/lib/ssl_db -M 4MB
  sslcrtd_children 8 startup=1 idle=1
  
  acl YOUTUBE ssl::server_name .googlevideo.com
  delay_pools 1
  delay_class 1 2
  delay_parameters 1 -1/-1 5120/5120
  delay_access 1 allow YOUTUBE
  
  coredump_dir /var/spool/squid
  refresh_pattern ^ftp:           1440    20%     10080
  refresh_pattern ^gopher:        1440    0%      1440
  refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
  refresh_pattern .               0       20%     4320
  cache_dir aufs /var/spool/squid 20000 49 256
  maximum_object_size 61440 KB
  minimum_object_size 3 KB
  
  cache_swap_low 90
  cache_swap_high 95
  maximum_object_size_in_memory 512 KB
  memory_replacement_policy lru
  logfile_rotate 4
  </code></pre>
  
  <p>try this <a href="http://tldp.org/HOWTO/TransparentProxy-6.html" rel="nofollow noreferrer">doc</a></p>
  
  <pre><code>iptables -t nat -A PREROUTING -i eth0 ! -s 109.0.0.110 -p tcp --dport 80 -j DNAT --to 109.0.0.110:3128
  iptables -t nat -A POSTROUTING -o eth0 -s 109.0.0.8/32 -d 109.0.0.110/32 -j SNAT --to 109.0.0.1
  iptables -A FORWARD -s 109.0.0.8/32 -d 109.0.0.110/32 -i eth0 -o eth0 -p tcp --dport 3128 -j ACCEPT
  </code></pre>
  
  <p>prescribed iptables</p>
  
  <p>I try to open a site on a test Windows (109.0.0.8) - access is denied, on Windows the gateway is 109.0.0.1, in the logs on squid</p>
  
  <pre><code>1546203601.533      0 109.0.0.110 TCP_MISS/403 4857 GET http://myip.ru/ - HIER_NONE/- text/html
  1546203601.533      1 109.0.0.1 TCP_MISS/403 4977 GET http://myip.ru/ - ORIGINAL_DST/109.0.0.110 text/html
  </code></pre>
  
  <p>tcpdump squid server</p>
  
  <pre><code>11:00:57.141246 IP 109.0.0.8.54026 &gt; myip.ru.http: Flags [F.], seq 1, ack 1, win 2087, length 0
  11:00:57.141570 IP 109.0.0.8.54030 &gt; myip.ru.http: Flags [S], seq 1736419147, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
  11:00:57.141971 IP myip.ru.http &gt; 109.0.0.8.54026: Flags [.], ack 2, win 58, length 0
  11:00:57.142115 IP myip.ru.http &gt; 109.0.0.8.54026: Flags [F.], seq 1, ack 2, win 58, length 0
  11:00:57.142304 IP myip.ru.http &gt; 109.0.0.8.54030: Flags [S.], seq 4065681746, ack 1736419148, win 29200, options [mss 1452,nop,nop,sackOK,nop,wscale 9], length 0
  11:00:57.142363 IP 109.0.0.8.54026 &gt; myip.ru.http: Flags [.], ack 2, win 2087, length 0
  11:00:57.142505 IP 109.0.0.8.54030 &gt; myip.ru.http: Flags [.], ack 1, win 260, length 0
  11:00:57.144743 IP 109.0.0.8.54025 &gt; myip.ru.http: Flags [P.], seq 2136:2856, ack 23054, win 2087, length 720: HTTP: GET / HTTP/1.1
  11:00:57.146027 IP myip.ru.http &gt; 109.0.0.8.54025: Flags [P.], seq 23054:23572, ack 2856, win 69, length 518: HTTP: HTTP/1.1 403 Forbidden
  </code></pre>
  
  <p>tell me what could be the problem, I will be grateful for any help?</p>
  
  <p><strong>Update</strong></p>
  
  <p>when you open a site on http by Windows, it is issued - 403, by https - an invalid certificate, the proxy server certificate is substituted in the browser, what am I doing wrong?</p>
  
  <p><strong>Update 2</strong></p>
  
  <p>when adding rules on a router</p>
  
  <pre><code>iptables -t nat -I PREROUTING -i eth0 -s 109.0.0.8 -p tcp --dport 80 -j DNAT --to 109.0.0.110:3128
  iptables -t nat -I PREROUTING -i eth0 -s 109.0.0.8 -p tcp --dport 443 -j DNAT --to 109.0.0.110:3129
  iptables -t nat -I POSTROUTING -o eth0 -s 109.0.0.8 -d 109.0.0.110 -j SNAT --to 109.0.0.1
  </code></pre>
  
  <p>proxy server rules</p>
  
  <pre><code>*nat
  :PREROUTING ACCEPT [314:20555]
  :INPUT ACCEPT [313:20511]
  :OUTPUT ACCEPT [844:60999]
  :POSTROUTING ACCEPT [2:130]
  -A PREROUTING -s 109.0.0.0/24 -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 3129
  -A PREROUTING -s 109.0.0.0/24 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
  -A PREROUTING -s 192.168.10.0/24 -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 3129
  -A PREROUTING -s 192.168.10.0/24 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
  -A PREROUTING -s 192.168.1.0/24 -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 3129
  -A PREROUTING -s 192.168.1.0/24 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
  -A POSTROUTING -s 109.0.0.0/24 -j SNAT --to-source 109.0.0.110
  -A POSTROUTING -s 192.168.10.0/24 -j SNAT --to-source 109.0.0.110
  -A POSTROUTING -s 192.168.1.0/24 -j SNAT --to-source 109.0.0.110
  COMMIT
  *filter
  :INPUT ACCEPT [340:18626]
  :FORWARD ACCEPT [0:0]
  :OUTPUT ACCEPT [1809:273786]
  -A INPUT -i lo -j ACCEPT
  -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
  -A INPUT -s 109.0.0.0/24 -j ACCEPT
  -A INPUT -s 192.168.1.0/24 -j ACCEPT
  -A INPUT -s 192.168.10.0/24 -j ACCEPT
  -A INPUT -j LOG
  -A INPUT -p tcp -m multiport --dports 3128:3130 -j DROP
  -A FORWARD -s 109.0.0.0/24 -p udp -m multiport --dports 80,443 -j DROP
  COMMIT
  </code></pre>
  
  <p>when you open a site on Windows on http, in cache.log</p>
  
  <pre><code>kid1| WARNING: Forwarding loop detected for:
  GET / HTTP/1.1^M
  Upgrade-Insecure-Requests: 1^M
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36^M
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8^M
  Accept-Encoding: gzip, deflate^M
  Accept-Language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7^M
  Via: 1.1 proxy.server (squid/3.5.27)^M
  X-Forwarded-For: 109.0.0.1^M
  Cache-Control: max-age=259200^M
  Connection: keep-alive^M
  Host: myip.ru^M
  ^M
  kid1| WARNING: Forwarding loop detected for:
  GET /favicon.ico HTTP/1.1^M
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36^M
  Accept: image/webp,image/apng,image/*,*/*;q=0.8^M
  Referer: http://myip.ru/^M
  Accept-Encoding: gzip, deflate^M
  Accept-Language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7^M
  Via: 1.1 proxy.server (squid/3.5.27)^M
  X-Forwarded-For: 109.0.0.1^M
  Cache-Control: max-age=259200^M
  Connection: keep-alive^M
  Host: myip.ru^M
  </code></pre>
  
  <p>in access.log</p>
  
  <pre><code>1546711344.892      0 109.0.0.110 TCP_MISS/403 4514 GET http://myip.ru/ - HIER_NONE/- text/html
  1546711344.893      0 109.0.0.1 TCP_MISS/403 4634 GET http://myip.ru/ - ORIGINAL_DST/109.0.0.110 text/html
  1546711344.913      0 109.0.0.110 TCP_MISS/403 4479 GET http://myip.ru/favicon.ico - HIER_NONE/- text/html
  1546711344.913      0 109.0.0.1 TCP_MISS/403 4599 GET http://myip.ru/favicon.ico - ORIGINAL_DST/109.0.0.110 text/html
  </code></pre>
  
  <blockquote>
    <p>WARNING: Forwarding loop detected for</p>
  </blockquote>
  
  <p>how to fix it, any help ?</p>