Talk:Transparent web proxy

From DD-WRT Wiki

Current revision

Has anyone done this last step successfully? http://wrt-wiki.bsr-clan.de/index.php?title=Squid_Transparent_Proxy

I'm trying to get the script to start whenever the router boots, but after pasting in the script, I can never return to the ~ # prompt that would enable me to enter the nvram commit command.

doesn't work

iptables -t nat -A POSTROUTING -o br0 -s 192.168.178.0/24 -p tcp -d 192.168.178.11 -j SNAT --to-source 192.168.178.10

iptables v1.3.3: Unknown arg `--to-source'

iptables -t nat -A POSTROUTING -o br0 -s 192.168.178.0/24 -p tcp -d 192.168.178.11 -j SNAT --to 192.168.178.10 iptables v1.3.3: Unknown arg `--to'

Try `iptables -h' or 'iptables --help' for more information.

i've got it working, but a few modifications were necessary for my setup using the vpn flavor of dd-wrt v24 rc6.2 on an asus wl500g premium.

[edit] rc_firewall script

i changed the rc_firewall script to this:

#!/bin/sh
PROXY_SERVER="192.168.2.7"
if [ -z $TRANSPARENT_PROXY ]; then
  /usr/sbin/iptables -t mangle -A PREROUTING -j ACCEPT -p tcp --dport 80 -s $PROXY_SERVER
  /usr/sbin/iptables -t mangle -A PREROUTING -j MARK --set-mark 3 -p tcp --dport 80
  /usr/sbin/ip rule add fwmark 3 table 2
  /usr/sbin/ip route add default via $PROXY_SERVER dev br0 table 2
  export TRANSPARENT_PROXY=1
else
  echo "This transparent proxy script stored in nvram rc_firewall has already run!"
  echo "If it hasnt, unset \$TRANSPARENT_PROXY manually via the shell."
fi

[edit] installing the script to nvram

i saved that script to a file named command.txt on my desktop pc and transferred it to the router using the scp command:
scp command.txt root@192.168.2.1:/tmp/root/

then i connected to the router using ssh:
ssh root@192.168.2.1
and used the following commands to install the transparent proxy:
nvram set rc_firewall="$(cat /tmp/root/command.txt)"; nvram commit; nvram get rc_firewall

Sed 23:19, 26 February 2008 (CET)

[edit] iptables on the squid server

on the squid server, i'm using this iptables command redirect http requests to the squid port, i'm using port 3129 for the transparent proxy, so the iptables setup looks like this:

iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3129

on my linux distribution, that rule is saved and set at boot time via the /etc/init.d/iptables init script.

you can verify that the iptables rule is in-place by typing:
iptables -t nat -L PREROUTING -v