How to transparent proxy

This post is in follow up to my post on dansguardian (web content filtering).

In that post I demonstrated how to configure dansguardian, iptables, and firefox the “long way” so people would understand the “basic” principles of what we were doing.

With this post I would like to show how to configure transparent proxies. Successful configuration of a transparent proxy means http traffic is automagically redirected. The advantage of this technique is that the system administrator does not need to manually configure each and every client for each and every user.

Advantage of a transparent proxy: Easy to set up (less work) and you get to show off a few nifty iptables rules.

Limitations of a transparent proxy: This technique does NOT work for ssl (https). This will thus be a trade off (very little ads / pr0n on https). If needed, you could manually configure your client (firefox) to use a proxy for https.

Note: In this post, I am assuming your default Policy in iptables is ACCEPT , if you change the default Policy to REJECT or DROP you will need to adjust the iptables rules accordingly.

In this post I will demonstrate how to do this on a single computer. The target audience is a home user needing to configure one or perhaps a few client computers.

Managing multiple computers on a large LAN is a bit complex and is thus beyond what I wanted to demonstrate in this blog. You would need to, at a minimum, set up a computer with two network interface cards – One to the internet and the second to your LAN. Squid is more common proxy in this user case (large LAN) as squid has more features. I would suggest you either look at a firewall specific distro (IPCop, IPFire, Vyatta), shorewall, or learn iptables and NAT. If you are wanting a transparent proxy on a large LAN I would refer you to one of the many how to’s on configuration of squid as a transparent proxy :

How to setup squid as a transparent proxy

Detailed how to configure squid as a transparent proxy

For this blog let us assume you have a single computer with several users and several http clients (firefox, chromium, opera, etc). Rather then configuring each and every user / client you can use a few “simple” rules in iptables.

This how to assumes you have installed and configured your proxy (tinyproxy, privoxy, squid, dansguardian). If you need to install and configure dansguardian, see my previous post on dansguardian.

I will demonstrate two user cases : privoxy alone and privoxy + dansguardian.

First user case – Privoxy

We need to configure privoxy and iptables.

Using any editor, open /etc/privoxy/config

sudo nano /etc/privoxy/config

Search (Ctrl-W) for and edit the following two lines :

Change:
listen-address localhost:8118

To:

listen-address 127.0.0.1:8118

And change

accept-intercepted-requests 0

To

accept-intercepted-requests 1

The privoxy configuration file explains these options.

Next add two rules to iptables:

sudo iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner --uid-owner root -j ACCEPT
sudo iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner ! --uid-owner privoxy -j REDIRECT --to-port 8118

The first line allows root (necessary if you wish to use apt-get)
The second line sets up privoxy as a transparent proxy for all users.

That’s all, no need to configure Firefox, wget, or any client.

If you use other proxies, use the appropriate user name. The user name for some common proxies are:

privoxy = privoxy
squid = proxy
tinyproxy = nobody
dansguardian = dansguardian

Second user case – Dansguardian

sudo iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner --uid-owner root -j ACCEPT
sudo iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner --uid-owner bodhi -j REDIRECT --to-port 8118
sudo iptables -t nat -A OUTPUT -p tcp --dport 8118 -m owner ! --uid-owner dansguardian -j REDIRECT --to-port 8080
sudo iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner ! --uid-owner privoxy -j REDIRECT --to-port 8080

The first line allows root (necessary if you wish to use apt-get).
The second line redirect parent’s (bodhi) to Privoxy (port 8118). Add additional users if needed. Omit this line if you wish all traffic to go through dansguardian.
The third line redirects people (other then bodhi) attempting to directly connect to privoxy (to circumvent dansguardian).
The forth line redirects children (everyone else not specifically redirected to privoxy) to dansguardian.

That’s all, no need to configure Firefox, Chromium, Opera, links, wget, or any client.

Configure iptables

The last step is to configure iptables so the above rules are active on boot.

Iptables – Use this section if you DO NOT use UFW

Set up iptables as above, then save your settings:

sudo bash -c “iptables-save > /etc/iptables.save”

Using any editor, open /etc/rc.local and add the following line (above exit 0)

iptables-restore /etc/iptables.save

exit 0

UFW – Use this section if you use UFW

Or if you use ufw you will need to manually edit /etc/ufw/before.rules. Add your rules at the bottom of the file.

The “trick” , however, is to add the proper syntax for the nat tables.

sudo nano /etc/ufw/before.rules

Add a section for nat, at the very bottom of the file, BELOW the COMMIT line (shown at the top of the edits below):

For Privoxy (without dansguardian)

# don’t delete the ‘COMMIT’ line or these rules won’t be processed
COMMIT

*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A OUTPUT -p tcp -m tcp --dport 80 -m owner --uid-owner root -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -m owner ! --uid-owner privoxy -j REDIRECT --to-port 8118

# don’t delete the ‘COMMIT’ line or these rules won’t be processed
COMMIT

Dansguardian + Privoxy

# don’t delete the ‘COMMIT’ line or these rules won’t be processed
COMMIT

*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A OUTPUT -p tcp -m tcp --dport 80 -m owner --uid-owner root -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -m owner --uid-owner bodhi -j REDIRECT --to-port 8118
-A OUTPUT -p tcp -m tcp --dport 8118 -m owner ! --uid-owner dansguardian -j REDIRECT --to-port 8080
-A OUTPUT -p tcp -m tcp --dport 80 -m owner ! --uid-owner privoxy -j REDIRECT --to-port 8080

# don’t delete the ‘COMMIT’ line or these rules won’t be processed
COMMIT

Bonus – Restrict external access to privoxy / dansguardian

Iptables

Neither Privoxy nor Dansguardian *should* accept requests from remote computers. If you wish to add rules to iptables to guarantee this, use the following:

Privoxy:

sudo iptables -A INPUT -p tcp -m tcp --dport 8118 -m state --state ESTABLISHED,RELATED -j ACCEPT

# For Localhost access only
sudo iptables -A INPUT -p tcp --dport 8118 -m state --state NEW ! -i lo -j DROP

#For access from your LAN
iptables -A INPUT -p tcp --dport 8118 -m state --state NEW ! -s 192.168.0.0/24 -j DROP

Privoxy + Dansguardian

sudo iptables -A INPUT -p tcp -m tcp --dport 8118 -m state --state ESTABLISHED,RELATED -j ACCEPT

# For Localhost access only
sudo iptables -A INPUT -p tcp -m multiport --dports 8118,8080 -m state --state NEW ! -i lo -j DROP

#For access from your LAN
iptables -A INPUT -p tcp -m multiport --dports 8118,8080 -m state --state NEW ! -s 192.168.0.0/24 -j DROP

Save your new iptables rules

sudo bash -c “iptables-save > /etc/iptables.save

UFW

Privoxy (Assuming your LAN is 192.168.0.0/24 and the Privoxy server IP is 192.168.0.10):

# Allow localhost only
sudo ufw deny 8118

Allow your LAN (assuming your LAN is 192.168.0.0/24
sudo ufw allow from 192.168.0.0/24 to 192.168.1.10 port 8118
sudo ufw deny 8118

Privoxy + Dansguardian

# Allow localhost only
sudo ufw deny 8080
sudo ufw deny 8118

Allow your LAN (assuming your LAN is 192.168.0.0/24
sudo ufw allow from 192.168.0.0/24 to 192.168.1.10 port 8080
sudo ufw allow from 192.168.0.0/24 to 192.168.1.10 port 8118
sudo ufw deny 8080
sudo ufw deny 8118

If you understand the basic principles in this post, configuring squid as a transparent proxy on a large LAN should be easier to comprehend.