Bypass FTP,RemoteLogin,SMTP,TELNET through Squid3 proxy server which is installed on ubuntu 14.04.1

Hi i have installed squid3 proxy server & the server is located between the switch & router all the traffic flows through squid3 server i am not able to:

1. Access FTP using filezilla software
2. Not able to update the mails as i am using thunderbird & microsoft outlook.
3. Not able to take remote of server outside the network using putty & Remote Desktop connection (Microsofts inbuilt tool)
4. Not able to send skype messages outside the network

5. Not able to commit or update in eclipse when the traffic flows through squid3 server below is the version & error in eclipse

   Version: Indigo Service Release 2
   Build id: 20120216-1857
   Eclipse IDE for Java Developers

   Error is propfind request failed on 'svn trunk'.

Above tasks works fine when connected directly to router but doesn't work when the traffic flows through squid3

I am able to

1. Browse http & https
2. Generate logs

I am not so familar with squid & iptables So please help me

I have not modified squid.conf file i have only entered the Network details & uncommented net.ipv4.ip_forward=1

which is present in /etc/sysctl.conf file

Below is the nework configuration

auto eth0 ( ON board Ethernet port & is connected to ROuter)
iface eth0 inet static
address 192.168.2.8
netmask 255.255.255.0
network 192.168.2.0
broadcast 192.168.2.255
gateway 192.168.2.5
dns-nameservers 192.168.2.5 8.8.8.8
auto eth1 ( LAN card IS connected to switch & clients are connected to switch)
iface eth1
inet static
address 192.168.1.120
netmask 255.255.255.0
network 192.168.1.0
broadcast 192.168.1.255
gateway 192.168.1.5
dns-nameservers 192.168.2.5 8.8.8.8

Clients have ip of 192.168.1.IP

Have checked entering the gateway 192.168.1.1 & 192.168.1.120(Squid proxy server address) at clients network settings

Below is my squid.conf file content

# Recommended minimum configuration:
#
# Example rule allowing access from your local networks.
# Adapt to list your (internal) IP networks from where browsing
# should be allowed
#acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
#acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
#acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
#acl localnet src fc00::/7 # RFC 4193 local private network range
#acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines
acl network src 192.168.0.0/24
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
# We strongly recommend the following be uncommented to protect innocent
# web applications running on the proxy server who think the only
# one who can access services on "localhost" is a local user
#http_access deny to_localhost
#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#
# Example rule allowing access from your local networks.
# Adapt localnet in the ACL section to list your (internal) IP networks
# from where browsing should be allowed
#http_access allow localnet
http_access allow localhost
http_access allow all

1 Answer

Try this solution

First, you do not use proxy for all traffic or you do?

If not, then you need to specify in you squid.conf port for http traffic

http_port 3128

On this way you can use proxy for http traffic. Setup in browser proxy and this is it

If you do not wish to setup each pc you can add iptables rule to take traffic with destinatio port 80 redirect to proxy

iptables -A PREROUTING -t nat -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128

This will also allow http traffic bypass proxy.

Also you need to setup iptables to do traffic forwarding from one nic to another

iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Your proxy is now configured to allow http traffic from local.