# SQUID+IPTABLES_can't set to work it correctly

## Demontager

I got problem with traffic redirecting to SQUID (i need redirect 80port only), my network configured in that way:

http://s001.radikal.ru/i193/1101/d3/70eca751340b.jpg

When any client in 172.16.0.0 network use Internet its traffic from 80 port doesn't appear in SQUID log (access.log).

And my IPTABLES settings:

```

#!/bin/bash

#wlan0 has internet and wlan1 not

#wlan0 192.168.0.0

#wlan1 172.16.0.0

iptables -F INPUT

iptables -F OUTPUT

iptables -F FORWARD

iptables -t nat -F POSTROUTING

iptables -t nat -F PREROUTING

iptables -t nat -F OUTPUT

iptables -P INPUT DROP

iptables -P FORWARD DROP

iptables -P OUTPUT ACCEPT

# allow local loopback connections

iptables -A INPUT -i lo -j ACCEPT

# drop INVALID connections

iptables -A INPUT   -m state --state INVALID -j DROP

iptables -A OUTPUT  -m state --state INVALID -j DROP

iptables -A FORWARD -m state --state INVALID -j DROP

# allow all established and related

iptables -A INPUT   -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A OUTPUT  -m state --state ESTABLISHED,RELATED -j ACCEPT

#allow pings

iptables -A INPUT -p icmp -j ACCEPT

#QUOTA for iPs in wlan1

iptables -A FORWARD -s 172.16.1.101 -m quota --quota 6291000 -j ACCEPT

iptables -A FORWARD -d 172.16.1.101 -m quota --quota 10490000 -j ACCEPT

iptables -A FORWARD -s 172.16.1.102 -m quota --quota 10490000 -j ACCEPT

iptables -A FORWARD -d 172.16.1.102 -m quota --quota 16781000 -j ACCEPT

iptables -A FORWARD -s 172.16.1.103 -m quota --quota 10490000 -j ACCEPT

iptables -A FORWARD -d 172.16.1.103 -m quota --quota 20980000 -j ACCEPT

iptables -A FORWARD -s 172.16.1.104 -m quota --quota 10490000 -j ACCEPT

iptables -A FORWARD -d 172.16.1.104 -m quota --quota 16781000 -j ACCEPT

iptables -A FORWARD -s 172.16.1.105 -m quota --quota 10490000 -j ACCEPT

iptables -A FORWARD -d 172.16.1.105 -m quota --quota 16781000 -j ACCEPT

iptables -A FORWARD -s 172.16.1.106 -m quota --quota 10490000 -j ACCEPT

iptables -A FORWARD -d 172.16.1.106 -m quota --quota 16781000 -j ACCEPT

iptables -A FORWARD -s 172.16.1.107 -m quota --quota 104857600 -j ACCEPT

iptables -A FORWARD -d 172.16.1.107 -m quota --quota 104857600 -j ACCEPT

#REDIRECT to SQUID

iptables -t nat -A PREROUTING -s 172.16.0.0/24 -o wlan0 -j DNAT --to-destination 192.168.1.110:3128 -p tcp -m tcp --dport 80

# log all other attempted out going connections

iptables -A OUTPUT -o wlan0 -j LOG

iptables -A FORWARD -j LOG

# set up IP forwarding and nat

iptables -t nat -A PREROUTING -s 172.16.0.0/24 -i wlan1 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.1.110:3128

```

Note: i got QUOTA module enabled it's due to I need limit traffic, because it not unlimited. That's why I want to use SQUID to save more traffic as well.

And my squid.conf:

```

http_port 192.168.1.110:3128  transparent

acl all src all

acl client_network src 192.168.1.110

acl localnet src 127.0.0.1/32

acl mynet src 172.16.1.0/24

visible_hostname myhost

http_access allow client_network

http_access allow localnet

http_access allow mynet

http_access deny all

access_log /var/log/squid/access.log squid

```

And when I start SQUID it writes:

```

gateway dem # /etc/init.d/squid start

squid                | * Initializing cache directory /var/cache/squid .. [ ok ]

squid                | * Starting squid ...

squid                |2011/01/10 00:25:39| WARNING: (B) '::/0' is a subnetwork of (A) '::/0'

squid                |2011/01/10 00:25:39| WARNING: because of this '::/0' is ignored to keep splay tree searching predictable

squid                |2011/01/10 00:25:39| WARNING: You should probably remove '::/0' from the ACL named 'all'   

```

Anyway I can use SQUID on LINUX-ROUTER, but when client do browsing, squid log is clear, so it means traffic not directed to squid.

Some info from netstat:

```

gateway dem #  netstat -lpn

Active Internet connections (only servers)

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    

tcp        0      0 0.0.0.0:139             0.0.0.0:*               LISTEN      5239/smbd           

tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      5108/cupsd          

tcp        0      0 192.168.1.110:3128      0.0.0.0:*               LISTEN      32447/(squid)       

tcp        0      0 0.0.0.0:445             0.0.0.0:*               LISTEN      5239/smbd           

udp        0      0 192.168.1.110:137       0.0.0.0:*                           5248/nmbd           

udp        0      0 172.16.1.110:137        0.0.0.0:*                           5248/nmbd           

udp        0      0 0.0.0.0:137             0.0.0.0:*                           5248/nmbd           

udp        0      0 192.168.1.110:138       0.0.0.0:*                           5248/nmbd           

udp        0      0 172.16.1.110:138        0.0.0.0:*                           5248/nmbd           

udp        0      0 0.0.0.0:138             0.0.0.0:*                           5248/nmbd           

udp        0      0 0.0.0.0:631             0.0.0.0:*                           5108/cupsd          

udp        0      0 0.0.0.0:34213           0.0.0.0:*                           32447/(squid)

```

And this gives iptables-save:

http://pastebin.com/9uUyLGDG

So, my main question and problem- Why traffic from 172.16.0.0 network not going to SQUID ?

----------

## Demontager

 *Demontager wrote:*   

> I got problem with traffic redirecting to SQUID (i need redirect 80port only), my network configured in that way:
> 
> http://s001.radikal.ru/i193/1101/d3/70eca751340b.jpg
> 
> When any client in 172.16.0.0 network use Internet its traffic from 80 port doesn't appear in SQUID log (access.log).
> ...

 

Seems i know why 172.16.0.0 net can't rich SQUID- it because FORWARD rule pass behind the local services. (in my case local services are SQUID)

http://savepic.ru/2098061.jpg

So I need to make QUOTAs in other way, guess it should be REDIRECT, but not sure. If yes, so how ?

----------

## Marq

I don't really know why are you talking about QUOTA (as you wrote, QUOTA limits are for 172.16.0.1 network) while the problem was incorrect redirection to SQUID from network 172.16.0.0?

----------

