Re: [squid-users] Transparent Proxy on OpenBSD 5.3 with Squid 3.2.7

On Mon, Nov 04, 2013 at 07:33:18PM +0100, Marko Cupać wrote:
>Before we dive deeper into this, let's clarify:
>- Do you have OpenBSD as a gateway to the Internet?
Yes

>- Are your physical interfaces named em0 and em1?
Yes

>- Is em0 connected to LAN, em1 to your ISP?
em0 = ISP
em1 = LAN

>- Can you ping some public IP address from OpenBSD box?
Yes

>- Can you browse the Web through OpenBSD gateway without adding proxy
>redirect rule?
Yes.
My pf.conf looks like that without the added proxy rule(s):
# The internal interface (connected to the local network)
ext_if="em0"
# The external interfaces (connected to the ipv4 and ipv6 network)
int_if="em1"

## Options
set loginterface $ext_if
set optimization aggressive

# scrub incomming packets
match on egress scrub (no-df)

# Set the default policy to return RSTs or ICMPs for blocked traffic
set block-policy drop

# Ignore the loopback interface entirely
set skip on lo0

anchor "ftp-proxy/*"

pass in quick on $int_if inet proto tcp to any port ftp \
divert-to 127.0.0.1 port 8021

## Translation rules

# NAT traffic on the interface in the default egress interface group (to
# which the interface out of which the default route goes is assigned) from the
# local network
match out on egress inet from $int_if:network to any nat-to (egress)

## Filtering rules

# Default deny rule. which all blocked packets logged.
block log all
block in log on $ext_if all
antispoof log for egress

# Pass all traffic to and from the local network, using quick so that later
# rules are not evaluated if a packet match this. Some rulesets would restrict
# local traffic much further
pass quick on $int_if all

# Permit all traffic going out, keep state so that replies are
# automatically passed many rulesets would have many rules here,
# restricting traffic in an out on the external (egress) interface.
# (keep state is not needed on the newest version of pf)
pass out quick
-------

Thank you Marko for patience with me!!!!

-- 
Marc Sontowski