I'm unable to find correct iptables lines for this.
I have a router who has one or more wlan clients (wlan0/10.13.37.x).
eth0 is connected to the internet (through other routers).
Squid is accessible over VPN (tun0/172.27.0.1).
All http requests passing the router, should be redirected to 172.27.0.1:8080.
Squid is set as transparant proxy.
Thanks
# Generated by iptables-save v1.4.13 on Tue Apr 24 00:45:14 2012
*nat
:PREROUTING ACCEPT [1:328]
:POSTROUTING ACCEPT [3:164]
:OUTPUT ACCEPT [3:164]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Tue Apr 24 00:45:14 2012
# Generated by iptables-save v1.4.13 on Tue Apr 24 00:45:14 2012
*filter
:INPUT ACCEPT [50:6468]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [149:28841]
-A INPUT -i lo -j ACCEPT
-A INPUT -i wlan0 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i wlan0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i tun0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 222 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 2222 -j ACCEPT
-A INPUT -p udp -m udp --dport 123 -j ACCEPT
-A INPUT -i tun0 -p tcp -m tcp --dport 4949 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 0:1023 -j DROP
-A INPUT -p udp -m udp --dport 0:1023 -j DROP
-A INPUT -p tcp -m tcp --dport 4949 -j DROP
-A FORWARD -d 10.13.37.0/24 -i wlan0 -j DROP
-A FORWARD -s 10.13.37.0/24 -i wlan0 -j ACCEPT
-A FORWARD -d 10.13.37.0/24 -i eth0 -j ACCEPT
COMMIT
# Completed on Tue Apr 24 00:45:14 2012
Best Answer
Pure iptables solution:
Another solution based on iptables and socat in case you don't want to mess too much with iptables: