Transparent reverse squid proxy

Discussion in 'Installation/Configuration' started by d31373, May 21, 2009.

  1. d31373

    d31373 New Member

    I believe that's what it would be called...Transparent Reverse Squid Proxy

    My company has only 1 external IP address to use.
    Our internal network topology is:
    1 x Cisco 831 Router
    1 x Cisco 3750 24port Switch
    2 x Physical CentOS 5.3 x64 Linux Servers running VMware 2.0
    1 x Physical CemtOS 5.3 i386 Linux Server running Asterisk
    1 x Virtual Windows Server 2003 x64 Standard with Exchange server 2007
    1 x Virtual Windows Server 2008 x64 Standard
    1 x Virtual Windows Server 2003 Standard
    1 x Virtual Windows XP Professional
    3 x Virtual appliances for network monitoring, etc.

    Obviously you would imaging, that accessing web interfaces of 6 servers has been quite challenging. I would like to setup a Squid Proxy in a VM to receive traffic for multiple ports.

    The ports are 80, 443, 8222, 8333, 10000 to name a few.

    I will be using CentOS 5.3 x64 and would like to know if anyone would be able to assist in configuring this. The only way to access the web interfaces would be through NATting the ports to the Squid Proxy.
    Thus our Router IP is, the Squid Proxy is, our Windows servers are in 1-29 range, and Linux servers are in the range 30-59.

    Preliminary Thoughts are:
    How would I configure Squid to accept multiple ports?
    How do I use squid to retreive the LAN based web interface and forward it out the Router without configuring Squid to be the gateway device?

    Thank you everyone for your considerations, and I am sorry if it appears that I do not know what I am doing. This will be my first Squid Proxy setup. I have used Linux for over 10 years, but with varying software, and the fact that most of my customers use Windows, causes me to lack some experience. Additionally I would like to use this as a learning experience in squid, proxying, and iptables.
    Last edited: May 21, 2009
  2. stefanos

    stefanos Member

    Hi d31373,

    I had a similar question and ended up going with a simple approach and doing it with apache's reverse proxy as a front end machine.

    I am guessing you could configure apache to listen on Port 80 & 8222 {vmware} and proxy to the server you want based on the header host.

    for https (443 & 8333) it's a bit more tricky as you need to read the headers.

    As for other traffic say ssh pop3 etc.. I don't think you can go through a proxy server it's just for http/https traffic and you will need to NAT to the server. i.e. port 25 would NAT to server A
    pop3 would NAT to server B etc..

    But I am not sure. If you find out how to do it please let me know.

  3. d31373

    d31373 New Member

    I think you nailed it right on the head. I ONLY want to forward http/https traffic.
    HTTP ports 80, 8088, 8222; HTTPS ports 443, 8333, 10000.

    it is only an issue of accessing the web interfaces of the servers inside of the network withour mapping external port 81 to port 80 on one server, external port 82 to port 80 and another server, etc.

    smtp = forwards to Exchange Server 2007
    rdp = forwards to Windows Server 2003
    vnc = forwards to vm1
    ssh = forwards to the proxy server, then establish ssh to other servers

    Do you have any idea how/where to begin? What should I research first? I have no problem doing footwork to get this completed, perhaps someone else with more know-how can help lay the foundation. Are there any linux distributions targeted specifically at tackling this particular issue? Something, I can use to base my experience (possibly implement temporarily)?
  4. stefanos

    stefanos Member

    Well I did it like this...{just got this from my history file}..

    apt-get install apache2
    a2enmod proxy
    a2enmod proxy_http
    /etc/init.d/apache2 force-reload

    a2enmod proxy_connect
    a2enmod ssl
    /etc/init.d/apache2 force-reload

    ###Create vhost file in /etc/apache2/sites-available/ as follows

    <VirtualHost *:80>

    ProxyRequests Off

    <Proxy *>
    Order deny,allow
    Allow from all

    ProxyPass /
    ProxyPassReverse /

    /etc/init.d/apache2 reload

    I think you will also need to add into /etc/apache2/ports.conf to listen on the ports you want.

    My HTTP works fine I have not tried with https yet.

    So I will pass on where I got all my info from:

    Hope this helps.
  5. d31373

    d31373 New Member

    THANK YOU! I will begin working on implementing, any additional info would be greatly appreciated, hopefully I will have something up by mid next week.
  6. stefanos

    stefanos Member

    This is just to add some addition info I found that might be of help for anyone reading this post: it's about logging behind a proxy server. It has some problems as X-Forwarded-For can have multiple ip addresses. If anyone knows how to solve this I would be grateful.

    I do my logging this way as opposed to apache's suggestion just to change the %h because I was unsure what would happen to my logs if the X-Forwarded-For was not set (eg if a local request was made from/to the server say via a cgi script).

    LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined
    LogFormat "%v:%p %{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" log_x_forward_for
    SetEnvIf X-Forwarded-For "^.*\..*\..*\..*" is-forwarder
    CustomLog /var/log/apache2/other_vhosts_access.log vhost_combined env=!is-forwarder
    CustomLog /var/log/apache2/other_vhosts_access.log log_x_forward_for env=is-forwarder
    hope it help

Share This Page