Cara konfigurasi Proxy external single port

saya ambil atau copy paste dari grup facebook ipfire indonesia,yaitu pak fajar.

biar gak hilang atau tertimbun oleh panjangnya post di facebook.




Khusus untuk webproxy bawaan IPFire (squid 3.x) atau addon squid-2.7STABLE9.




Non-aktifkan transparent di web interface -> Save & Restart




Edit file atau tambahkan file /etc/squid/squid.conf.pre.local, tambahkan baris berikut :

http_port 3129 transparent tproxy

[root@IPFire ~]# modprobe xt_TPROXY

[root@IPFire ~]# modprobe xt_socket

[root@IPFire ~]# modprobe nf_tproxy_core

[root@IPFire ~]# modprobe xt_mark

[root@IPFire ~]# modprobe nf_nat

[root@IPFire ~]# modprobe nf_conntrack_ipv4

[root@IPFire ~]# modprobe nf_conntrack

[root@IPFire ~]# modprobe nf_defrag_ipv4

[root@IPFire ~]# modprobe ipt_REDIRECT




Sesuaikan IP Address pada interface green. Sebagai contoh, saya pake 172.16.5.1




[root@IPFire ~]# iptables -t mangle -N DIVERT

[root@IPFire ~]# iptables -t mangle -A DIVERT -j MARK --set-mark 1

[root@IPFire ~]# iptables -t mangle -A DIVERT -j ACCEPT

[root@IPFire ~]# iptables -t mangle -A INPUT -j ACCEPT

[root@IPFire ~]# iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT

[root@IPFire ~]# iptables -t mangle -A PREROUTING -d 172.16.5.1/32 -p tcp --dport 80 -j ACCEPT
[root@IPFire ~]# iptables -t mangle -A PREROUTING -d 172.16.5.1/32 -p tcp --dport 3128 -j ACCEPT
[root@IPFire ~]# iptables -t mangle -A PREROUTING ! -d 172.16.5.1/32 -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129




[root@IPFire ~]# ip rule add fwmark 1 lookup 100
[root@IPFire ~]# ip route add local 0.0.0.0/0 dev lo table 100
[root@IPFire ~]# sysctl net.ipv4.ip_nonlocal_bind=1
[root@IPFire ~]# sysctl net.ipv4.ip_forward=1


Setting Mikrotik :
/ip firewall mangle
add action=mark-routing chain=prerouting disabled=no dst-port=80 \
in-interface=ether1-client new-routing-mark=proxy passthrough=no protocol=tcp
add action=mark-connection chain=prerouting disabled=no dst-port=80 \
in-interface=ether5-PROXY new-connection-mark=tproxy passhrough=yes protocol=\
tcp src-address=!172.16.5.1
add action=mark-routing chain=prerouting connection-mark=tproxy disabled=no \
in-interface=!ether5-proxy new-routing-mark=proxy passthrough=no

Share This