transparent proxy w Linux and 3Com Netbuilder

From: Enric <>
Date: Fri, 13 Mar 1998 12:40:21 +0100 (MET)


I have read the thread about "Transparent proxy with Linux 2.0.29 and
CISCO IOS 11.1", and in particular the message from Brian

We have the same configuration that Brian:

squid 1.1.20 on a Linux (RH 5.0) box 2.0.33 kernel version and a router
from 3Com (Netbuilder II) (not CISCO as Brian).
The Linux kernel is configured the same way Brian says.
Also, the same lines for ipfwadm and the same for the squid.conf parameters.

We have some subnets defined (I don't know if Brian also) and the _problem
is here_ (I think).

The following scheme shows some of our subnets:

 Subnet: / 24
  +-------+ +-------------+
  | pipa |--------------------| NetBuilder |-----> To Internet
  +-------+ +-------------+ |
         | |
      +-------+ +-------+
      | Squid | | Conto |
      +-------+ +-------+
  Subnet: / 24
- The NetBuilder permits outgoing traffic and redirects the
  www traffic from and subnets to Squid box

- The IP Firewall installed on linux box redirects the www traffic to
  their local port 3128 ( on this port is listening the Squid software ).

The results are:

- From / 24 subnet all works fine (the browsers with
  direct connections and squid sofware)

- From / 24 subnet does not. Opera(3.0 demo version) browser
  seems work fine. Netscape (4.04) and IE (4.0) does not. The data seems to
  reach the squid box (soem times) but not returns to the client
  browsers. And sometimes seems no data arrive to squid.
  The error Netscape says is: A network error occurred while Netscape was
  receiving data. Network error: connection reset by peer. And in the squid
  access.log file appears the lines showing the conection is done
  (TCP_MISS, GET and DIRECT). When I clik on the OK button on the previous
  error message, the browser seems to continue receiving data but finally
  the connection finish anf the data is not totally retieved.
  If then, I click th reload button, in the access log appears
  TCP_CLIENT_REFRESH, GET and DIRECT and seems get some chunks of data.
  When later I try again, only receive the error message and no data is
  This is a rare behaviour. I can say it not works at all.

In short:

from the clients on the same subnet that the squid box, works OK, and
from any other subnet does not.

Please, can someone help me ?
Thank you.

-----Original Message----
From: Brian []
Sent: Wednesday, March 11, 1998 8:16 AM
To: Chuck Pitre
Cc: Squid Users
Subject: Re: transparent proxy with LINUX 2.0.29 and CISCO IOS 11.1

Here is how I have Transparent proxying working for me, in an enviroment
where my router is a Cisco 2501 running IOS 11.1, and Squid machine is
running Linux 2.0.33.

Many thanks to the following individules and the squid-users list for
helping me get redirection and transparent proxying working on my
Cisco/Linux box.

Lincoln Dale
Riccardo Vratogna
Mark White
Henrik Nordstrom

First, here is what I added to my Cisco, which is running IOS 11.1. In
IOS 11.1 the route-map command is "process switched" as opposed to the
faster "fast-switched" route-map which is found in IOS 11.2 and later.
You may wish to be running IOS 11.2. I am running 11.1, and have had no
problems with my current load of about 150 simultaneous connections to

interface Ethernet0
description To Office Ethernet
ip address
no ip directed-broadcast
no ip mroute-cache
ip policy route-map proxy-redir
access-list 110 deny tcp host any eq www
access-list 110 permit tcp any any eq www
route-map proxy-redir permit 10
match ip address 110
set ip next-hop

So basically from above you can see I added the "route-map" declaration,
and an access-list, and then turned the route-map on under int e0 "ip
policy route-map proxy-redir"

ok, so the Cisco is taken care of at this point. The host above:, is the ip number of my squid host.

My squid box runs Linux, so I had to do the following on it:

my kernel (2.0.33) config looks like this:

# Networking options
# CONFIG_NET_ALIAS is not set
# CONFIG_IP_ACCT is not set

You will need Firewalling and Transparent Proxy turned on at a minimum.

Then some ipfwadm stuff:

# Accept all on loopback
ipfwadm -I -a accept -W lo
# Accept my own IP, to prevent loops (repeat for each interface/alias)
ipfwadm -I -a accept -P tcp -D 80
# Send all traffic destinated to port 80 to Squid on port 3128
ipfwadm -I -a accept -P tcp -D 0/0 80 -r 3128

it accepts packets on port 80 (redirected from the Cisco), and redirects
them to 3128 which is the port my squid process is sitting on. I put all
this in /etc/rc.d/rc.local

and the squid is configured as:

http_port 80
icp_port 3130
httpd_accel virtual 80
httpd_accel_with_proxy on

I am using v1.1.20 of the squid with the patch at:

installed. You will want to install this patch if using a setup similar
to mine.

This works great. Many thanks again to all of those listed above in
helping me.


/-------------------------- -----------------------------\
| Brian Feeny | USR TC Hubs | ShreveNet Inc. (318)222-2638 |
| Network Administrator | Perl, Linux | Web hosting, online stores, |
| ShreveNet Inc. | USR Pilot | Dial-Up 14.4-56k, ISDN & LANs |
| 89 CRX DX w/MPFI, lots of |-=*:Quake:*=-| |
| mods/Homepage coming soon |LordSignal/SN| Quake server: |
\-------------------------- 318-222-2638 x109 -----------------------------/

Enric Navarro Sanchis.Analista Sistemas.
                | Do Not Buy Ivory |
                | Ivory Belongs Only | (And Walrus Also)
                | To Elephants |
Received on Fri Mar 13 1998 - 03:56:41 MST

This archive was generated by hypermail pre-2.1.9 : Tue Dec 09 2003 - 16:39:21 MST