Transparent Proxy Server, Squid 3.3.2 / 3.2.8 on Ubuntu 12.10 + Shorewall

Squid 3.1.xx (latest version 3.1.23), is a very simple and is used to make transparent / intercept. While the squid 3.3.2 / 3.2.8, to make transparent / intercept configuration is a bit different from the version of squid 3.1.23.  In this blog, I will explain how to create a transparent / intercept in two ways, the first is squid as well as a router, and the second, Mikrotik as a router coupled with squid external. Let's get to start, a transparent proxy server with squid as well as router.

Network configuration.
After installing the new Ubuntu, configure the ethernet. In my case, Ethernet to the Internet is dhcp, and another ethernet to the LAN, using the IP address 10.10.10.1. Of course, customize your network environment.

vi /etc/network/interfaces

# The loopback network interface
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet dhcp
auto eth1
iface eth1 inet static
address 10.10.10.1
netmask 255.255.255.0
dns-nameservers 8.8.8.8

service networking restart
netstat -nr

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         192.168.1.1    0.0.0.0         UG        0 0          0 eth0
10.10.10.0      0.0.0.0         255.255.255.0   U         0 0          0 eth1
192.168.1.0    0.0.0.0         255.255.255.0   U         0 0          0 eth0

If you are connected to the internet. Continue to the next step.

apt-get update
apt-get install vim mc make gcc g++

Install Squid
Download squid file at  http://www.squid-cache.org

cd /usr/local
wget http://www.squid-cache.org/Versions/v3/3.3/squid-3.3.2.tar.gz
tar zxvf squid-3.3.2.tar.gz
cd squid-3.3.2
./configure --prefix=/usr   --exec-prefix=/usr   --bindir=/usr/sbin   --sbindir=/usr/sbin   --sysconfdir=/etc/squid   --datadir=/usr/share/squid   --includedir=/usr/include   --libdir=/usr/lib   --libexecdir=/usr/lib/squid   --localstatedir=/var   --sharedstatedir=/usr/com   --mandir=/usr/share/man   --infodir=/usr/share/info   --x-includes=/usr/include   --x-libraries=/usr/lib   --enable-shared=yes   --enable-static=no   --enable-carp    --enable-storeio=aufs,ufs   --enable-removal-policies=heap,lru   --disable-icmp   --disable-delay-pools   --disable-esi   --enable-icap-client   --enable-useragent-log   --enable-referer-log   --disable-wccp   --enable-wccpv2   --disable-kill-parent-hack   --enable-snmp   --enable-cachemgr-hostname=localhost   --enable-arp-acl   --disable-htcp  --disable-forw-via-db   --disable-follow-x-forwarded-for   --enable-cache-digests    --disable-poll   --enable-epoll   --enable-linux-netfilter   --disable-ident-lookups   --enable-default-hostsfile=/etc/hosts    --with-default-user=squid   --with-large-files  --enable-mit=/usr   --with-logdir=/var/log/squid   --enable-http-violations   --enable-zph-qos   --with-filedescriptors=65536   --enable-gnuregex --enable-async-io=64 --with-aufs-threads=64  --with-pthreads --with-aio  --enable-default-err-languages=English --enable-err-languages=English --disable-hostname-checks --enable-underscores
make; make install
cd /etc/squid
mv squid.conf squid.conf.old
vim squid.conf

Squid.conf can be obtained from http://myconfigure.blogspot.com/2013/03/squid-332-328-example-squidconf.html.  Copy and place it in /etc/squid/squid.conf. Do not forget saved. If you are using squid configuration that I use, continue the following steps, so that squid is not an error.

useradd squid
cd /etc/squid/
mkdir swap
chown squid:squid /etc/squid/swap
mkdir /cache
chown squid:squid /cache
chown -Rf squid:squid /var/log/squid/
vim /etc/init.d/squid 

Find and get the contents of the startup file at http://myconfigure.blogspot.com/2012/03/missing-file-startup-squid.html, and place it in /etc/init.d/squid. After saved, change the permissions.

======Update ... because of the question of who tried this, and failed :)=====
See squid.conf again, make sure, "acl" is correct. In squid.conf example, acl = 192.168.10.0. Because in this post, the user's IP address is 10.10.10.0/24, then change acl in squid.conf, so it should be like this,

acl bamboe src 10.10.10.0/24

Then, if you are using another IP address, do not forget to adjust the acl in squid too. Save and continue to the steps below

chmod 755 /etc/init.d/squid
update-rc.d squid defaults
squid -z
service squid restart
until this point, squid should be ok.

Install Shorewall.

Download shorewall file at http://www.shorewall.net
wget http://baltimore.shorewall.net/pub/CURRENT_STABLE_VERSION_IS_4.5/shorewall-4.5.13/shorewall-4.5.13.tgz
wget http://baltimore.shorewall.net/pub/CURRENT_STABLE_VERSION_IS_4.5/shorewall-4.5.13/shorewall-core-4.5.13.tgz
tar zxvf shorewall-core-4.5.13.tgz
cd shorewall-core-4.5.13
./configure
./install.sh
cd ..
tar zxvf shorewall-4.5.13.tgz
cd shorewall-4.5.13
./install.sh
cp /usr/share/shorewall/configfiles/* /etc/shorewall/
cd /etc/shorewall/

Edit some files below, and make sure there are some command lines in each file.

zones
###########################
fw firewall
net ipv4
loc ipv4

interfaces
###########################
net eth0
loc eth1


masq
###########################
eth0 10.10.10.0/24

policy
###########################
loc net ACCEPT
fw net ACCEPT
loc fw ACCEPT
net all DROP
all all REJECT

rules
###########################
SECTION NEW
REDIRECT loc 3127 tcp www -

shorewall.conf
STARTUP_ENABLED=Yes

 Add the following line to /etc/rc.local, in order to automatically run.

shorewall restart
exit 0

Done. It’s time to try from  computer client.

Note Update. 
There is no difference, for new version squid, 3.3.3 and 3.2.9. I've tried and succeeded.