Iptables – preventing squid forwarding loop with IPtables

amazon ec2iptablessquidtransparent-proxyubuntu-12.04

I have a web application, and I'd like to limit file upload size.

I thought I'd try using squid for this, via its directive request_body_size_max.

I have my webserver running on port 8080, and I've installed squid 3.1.19 on the same server (Ubuntu 12.04 LTS). The server is running on Amazon's EC2, if that makes any difference.

squid.conf contains:

http_port 3128 transparent

I added to IPTables:

iptables -t nat -A PREROUTING -p tcp --dport 8080 -j REDIRECT --to-port 3128

When I visit the webserver, the result in squid's logs, is:

Forwarding loop detected.

What do I need to do to prevent this? thanks…

Best Answer

The problem is when squid tries to connect to the web server (on port 8080) it's request is also redirected to itself. You must limit the scope of the REDIRECT rule (e.g. based on the incoming interface).

If the outside interface on your server is eth0 change the rule like this:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 8080 -j REDIRECT --to-port 3128

Update: On the second thought looks like I'm wrong. Local (127.0.0.1) traffic doesn't go through the PREROUTING chain.

How did you tell squid what upstream web server to use?

Related Topic