Iptables – route all passing traffic on port 80 over router to external squid system

iptablesroutingsquid

I'm unable to find correct iptables lines for this.

I have a router who has one or more wlan clients (wlan0/10.13.37.x).
eth0 is connected to the internet (through other routers).
Squid is accessible over VPN (tun0/172.27.0.1).

All http requests passing the router, should be redirected to 172.27.0.1:8080.

Squid is set as transparant proxy.

Thanks

# Generated by iptables-save v1.4.13 on Tue Apr 24 00:45:14 2012
*nat
:PREROUTING ACCEPT [1:328]
:POSTROUTING ACCEPT [3:164]
:OUTPUT ACCEPT [3:164]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Tue Apr 24 00:45:14 2012
# Generated by iptables-save v1.4.13 on Tue Apr 24 00:45:14 2012
*filter
:INPUT ACCEPT [50:6468]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [149:28841]
-A INPUT -i lo -j ACCEPT
-A INPUT -i wlan0 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i wlan0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i tun0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 222 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 2222 -j ACCEPT
-A INPUT -p udp -m udp --dport 123 -j ACCEPT
-A INPUT -i tun0 -p tcp -m tcp --dport 4949 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 0:1023 -j DROP
-A INPUT -p udp -m udp --dport 0:1023 -j DROP
-A INPUT -p tcp -m tcp --dport 4949 -j DROP
-A FORWARD -d 10.13.37.0/24 -i wlan0 -j DROP
-A FORWARD -s 10.13.37.0/24 -i wlan0 -j ACCEPT
-A FORWARD -d 10.13.37.0/24 -i eth0 -j ACCEPT
COMMIT
# Completed on Tue Apr 24 00:45:14 2012

Best Answer

Pure iptables solution:

# redirect to squid
iptables -t nat -A PREROUTING --src 10.13.37.0/24 -p tcp -m tcp --dport http \
         -j DNAT --to-destination 172.27.0.1:8080

# route clients to squid
sysctl -w net.ipv4.ip_forward=1

iptables -t filter -I FORWARD --src 10.13.37.0/24 --dst 172.27.0.1 \
         -p tcp -m tcp --dport 8080 \
         -j ACCEPT

iptables -t filter -I FORWARD -m conntrack --ctstate ESTABLISHED,RELATED \
         -j ACCEPT

# masquerade (snat) clients in case the VPN doesn't know about the LAN
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

Another solution based on iptables and socat in case you don't want to mess too much with iptables:

iptables -t nat -A PREROUTING --src 10.13.37.0/24 -p tcp -m tcp --dport http \
         -j REDIRECT --to-ports 8080

socat TCP4-LISTEN:8080,bind=127.0.0.1,fork TCP4:172.27.0.1:8080
Related Topic