Here's my network configuration:

My network configuration http://daveden.files.wordpress.com/2013/05/network-configuration.png

The proxy server is running Ubuntu with Squid on port 3128 and DansGuardian on port 8080.

I'd like to force all clients to use the proxy server - specifically, port 8080 - for any TCP/UDP access. However, I don't want to transparently redirect.

How do I do this? Can I just drop packets if the client isn't configured to use the proxy server on port 8080?

I'd like whatever system I come up with to work on the proxy server itself as well. It's the only desktop computer in the house, so it'd be nice if I could allow people in my household to use it but still know that they're protected.

closed as off topic by Ayrx, TildalWave, Adi, NULLZ, AJ Henderson May 22 '13 at 16:19

Questions on Information Security Stack Exchange are expected to relate to Information security within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    It may be a question for serverfault.com ! – F. Hauri May 22 '13 at 6:38
  • You either run a transparent proxy or block web traffic and manually setup the proxy on all clients. – Jason H May 22 '13 at 10:56
  • Why don't you want to transparently redirect? Seems the easiest solution. You could implement a captive portal to explain users what to do, and thus avoid the "The Internet is not working for me!" syndrome, but why suffer needlessly? – LSerni May 22 '13 at 15:26
  • Closed as off topic??? The guys at Server Fault said I should ask here! – David Kennedy May 22 '13 at 16:57
  • The reason I don't want to transparently redirect is because that doesn't work for HTTPS. – David Kennedy May 22 '13 at 17:13

You have a couple options:

  • Use something like WCCP and function transparently
  • Be an inline proxy, as it seems you are now.
  • Use WPAD to send the devices to a box hosting your PAC file.
  • Manually specify the proxy in your clients.

However, this all depends on what you're exactly running, and if your devices support it (Can blenders handle PAC files?). If possible, I suggest using WPAD, but you should be aware of MITM vulnerabilities.

Also, to address your question about dropping TCP/UDP packets which aren't proxied, just drop everything that doesn't have a source of your proxy, at any point after the ingress interface of the proxy. Unfortunately, if you want to do this with a separate device, that device will have to reside between your proxy and modem.

You can also set your proxy up to do it by either using iptables on your proxy egress interface, or you could just not route traffic outbound for other internal devices... But the second solution would also extend past TCP/IP to include ICMP, IP Protocols, etc.


You could redirect packet to send them to your proxy

This method is called transparent proxy

You may find some cookbooks there:

Not the answer you're looking for? Browse other questions tagged or ask your own question.