Transparent Proxy

[suppo]

NG (R55)

Hi

This question has been asked previously but i don't think it was conclusively resolved.

Im trying to set up a transparent proxy. I've set up a rule as previously discussed using http_mapped. In the advanced settings within http_mapped i've specified the following:

SRV_REDIRECT(80,<Proxy_IP>,8080).

The rule reads:

Test_Subnet | any | http_mapped | Accept.

I'm seeing http traffic in the logs for test_subnet being allowed by the redirect rule, but the pages aren’t being displayed. I've sniffed the traffic going to the proxy and nothing appears to be being redirected.

Any help appreciated!

[dsb.nepo]

It is not possible to have the clients an the proxy behind the same Firewall interface.
To make things cleer a little drawing

|----|
|    |[eth0]---- LAN (proxy clients)
| FW |[eth2]---- DMZ (proxy)
|    |[eth3]---- WAN
|----|

Now you can make the ruleset: (!=negated)

---------------------------------------------
source    destination   proto         action
---------------------------------------------
proxy     !Firewall     http          accept
          !internal
-----------------------------------------------
LAN       !Firewall     http_mapped   accept
          !internal
---------------------------------------------

[Robby Cauwerts]

This should work.

The following is an output of the traffic where .15 is a host on the LAN and .2 is the proxy:
18:30:48.693246 I 192.168.254.15.4441 > 213.239.154.35.80: S 3468993172:3468993172(0) win 16384 <mss 1360,nop,nop,sackOK> (DF)
18:30:48.693820 O 192.168.254.15.4441 > 192.168.254.2.8080: S 3468993172:3468993172(0) win 16384 <mss 1360,nop,nop,sackOK> (DF)

So both src and dst on the same interface.
The capture filter was: tcpdump -ni internal_interface 'host 192.168.254.2 or host 192.168.254.15 and port 80 or port 8080'

The rulebase is the same as yours:
src: LAN
dst: ANY
service: http_mapped
accept

Run your test again and capture the traffic on all your interfaces.
Take into account your NAT rules.

[dsb.nepo]

Yes,
as I can see it works at the same interface.
I forgot that I have ACLs at the switch, between the Clients and the Firewall.