Ubuntu – Routing your Internet through openvpn and Squid Proxy

openvpnsquidUbuntu

I am trying to setup a proxy to filter the internet traffic. In order to do so have arrived at the following combination Client -> Openvpn -> squidproxy -> internet
Squid proxy and openvpn have been installed on the same ubuntu server. Installed openvpn though this Digital Ocean tutorial. Openvpn is currently working and routing the traffic correctly to internet. But I have not been able to force the requests to go through squid proxy, even after setting it up to route transparently and adding a few iptables configuration.

I have also added this configuration post which the http requests on port 80 do not reach internet nor reach the squid proxy (http_port 3128 transparent is defined in squid.conf to transparently intercept the request)

-A PREROUTING -i tun0 -p tcp --dport 80 -j DNAT --to 10.0.2.15:3128
-A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128

Best Answer

Looking at what you've done, I can't see anything wrong - though there are some significant gaps.

A growing proportion of the web is running on HTTPS only. And I would expect an application like Whatsapp to use SSL for all its traffic. While it is possible to relay the SSL traffic on the proxy server (using a simple port forwarder like socat) if you need the capability to monitor the data being exchanged then that's a much more complex proposition. Squid does have the capability to generate SSL certs on the fly and hence decrypt/re-encrypt traffic. But this requires the root CA you are using to be installed on the client devices - which will be rather difficult to do on mobile devices which have not been rooted.