Hello Guys,
I have a debian machine that work as a firewall (iptables + squid 2.6) with two physical interfaces: eth0 (public interface) and eth1 (internal interface LAN). I have created an alias eth1:1 in order to have two subnets on same physical interface:
cat/etc/network/interfaces
auto eth0
iface eth0 inet static
address 111.111.11.x11
netmask 255.255.255.0
gateway set to the IP router
auto eth1
iface eth1 inet static
address 172.16.2.1
netmask 255.255.255.0
auto eth1:1
iface eth1 inet static
address 172.16.3.1
netmask 255.255.255.0
My intention is to translate the two internals LAN subnets with own public IP.
I added an alias eth0:1 with another public IP 111.111.11.x12
On iptables I have created the following rules:
-A POSTROUTING -o eth0 -s 172.16.2.0/24 -j SNAT --to 111.111.11.x11
-A POSTROUTING -o eth0 -s 172.16.3.0/24 -j SNAT --to 111.111.11.x12
-A FORWARD -P DROP
-A FORWARD -p tcp -m multiport -i eth1 -o eth0 -j ACCEPT --dports 80,443,25,110,21,995,465
-A FORWARD -m state -i eth0 -o eth1 --state ESTABLISHED,RELATED -j ACCEPT
If I stop the proxy service with the rules declared above the two subnets are translated correctly. 172.16.2.0/24 with the IP of eth0 and the other(172.16.3.0/24) with the ip of eth0:1
If I enable squid that is listening on port 8080 in transparent mode on the same machine with the following rules to iptables:
-A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 8080
-A INPUT -P DROP
-A INPUT -p tcp -i eth1 -j ACCEPT --dport 8080
-A FORWARD -P DROP
-A FORWARD -p tcp -m multiport -i eth1 -o eth0 -j ACCEPT --dports 443,25,110,21,995,465 (I have removed 80 port)
-A FORWARD -m state -i eth0 -o eth1 --state ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -P DROP
-A OUTPUT -p tcp -j ACCEPT --sport 8080
Squid file (cat/etc/squid/squid.conf):
http_port 8080 transparent
visible_hostname proxy
cache_mem 256 MB
cache_swap_low 90
cache_swap_high 95
maximum_object_size 2024 KB
cache_effective_user proxy
cache_effective_group proxy
coredump_dir/var/spool/squid
access_log/var/log/squid/access.log
acl lan src 172.16.0.0/16 (I set /16 to allow two subnets to pass from squid)
acl all src 0.0.0.0/0.0.0.0
http_access allow lan
http_access deny all
From log file I see that both subnets are redirected to the proxy but I have seen that now the two subnets are translated both with the IP of eth0
What should I do to resolve this problem?
Thank you and good summer to all