Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have an Ubuntu 10.04 box that was once configured as Squid Transparent Proxy. Navigation was perfect: my windows clients had no troubles.

The problem I had was that users were not able send or receive mail using outlook (and outlook express). So I've googled here and there and found out a solution:

sudo iptables -t nat -A POSTROUTING -p TCP --dport 25 -j MASQUERADE

sudo iptables -t nat -A POSTROUTING -p TCP --dport 110 -j MASQUERADE

Everything went great.

Now I've enabled squid authentication (the simple one using a text file) and my outlook and outlook express stopped working again. I've read that the problem is not really squid related because it won't proxy smtp or pop... But I still need to solve it. NAT? Port forwarding?

What kind of commands should I use?

The squid server has a single NIC and can get on the internet and solve names using opendns servers witout problems.

configuration on server: ip 192.168.1.210 subnet 255.255.255.0 gateway 192.168.1.5

On clients I use: ip 192.168.1.x subnet 255.255.255.0 gateway 192.168.1.210

I can add further details so please ask but I don't know what could be needed to solve the problem.

EDIT:

sudo iptables -L

Chain INPUT (policy ACCEPT)

target prot opt source destination

fail2ban-ssh tcp -- anywhere anywhere multiport dports ssh

Chain FORWARD (policy ACCEPT)

target prot opt source destination

Chain OUTPUT (policy ACCEPT)

target prot opt source destination

Chain fail2ban-ssh (1 references)

target prot opt source destination

RETURN all -- anywhere anywhere

sudo iptables -L -t nat

Chain PREROUTING (policy ACCEPT)

target prot opt source destination

REDIRECT tcp -- anywhere anywhere tcp dpt:www redir ports 3128

Chain POSTROUTING (policy ACCEPT)

target prot opt source destination

MASQUERADE tcp -- anywhere anywhere tcp dpt:smtp

MASQUERADE tcp -- anywhere anywhere tcp dpt:pop3

Chain OUTPUT (policy ACCEPT)

target prot opt source destination

share|improve this question
1  
Please add output of iptables -L and iptables -L -t nat, to see what your firewall configuration looks like, and contents of /proc/sys/net/ipv4/ip_forward (should be just the number "1"). You're right that Squid should have absolutely nothing to do with it. Also please think if you changed anything other than squid authentication (did you reboot the server?) as that's what the problem may be. –  roadmr Jan 20 '12 at 22:17
    
I've added details: thanks :) –  Pitto Jan 23 '12 at 16:55

1 Answer 1

up vote 1 down vote accepted

I'm not sure what exactly you're going to achieve. As far as I understand you're going to use the machine with squid as router/firewall for the following scenario:

  1. allow web protocols (http/ftp) through squid only
  2. allow access to smpt/pop3 from your internal network to the outside via NAT.
  3. Your gateway to the internet is 192.168.1.5

Usually NAT translates from one Network (192.168.1.0/24) to another one (i.e. 84.145.77.23/32) and the other way around. So you might need to setup NAT rules on the your gateway machine 192.168.1.5 in order to work.

So that the outgoing path is:

client -> 192.168.1.210 ->NAT-> 192.168.1.5 ->NAT-> mailserver

And the incoming path for responses is:

mailserver -> 192.168.1.5 ->NAT-> 192.168.1.210 ->NAT-> client

As seen here 192.168.1.210 could be eliminated and the gateway could be configured accepting and NATing outgoing smtp/pop3 traffic from all clients and accepting outgoning http(s)/ftp traffic from 192.168.1.210 only.

Imho the second NAT between 192.168.1.210 and 192.168.1.5 might cause problems (same network) and is unnecessary.

To enable NAT in general on 192.168.1.210 please try the following first:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

change eth0 to your network interface name, if necessary.

share|improve this answer
    
This is absolutely what I should achieve! Can you please provide details on the commans I should digit to obtain step 1 & 2? –  Pitto Jan 22 '12 at 10:37
    
I can't modify settings on the 192.168.1.5 gateway so I'd simply like the 192.168.1.210 to forward pop and smtp requests to 192.168.1.5 –  Pitto Jan 22 '12 at 11:28
    
According to your output above, could you try to change the smtp/pop rules to use a specific interface? –  Axel Jan 23 '12 at 20:59
    
I cannot edit my comment above. sorry. According to your output above, could you try to change the smtp/pop rules to use a specific interface without specific ports? With iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE. The rules above only allow forwarding for ports 25 and 110 forth and back. But the client that established the connection would have another (random) port than 25 or 110. –  Axel Jan 23 '12 at 21:06
    
Ok... So I have to digit iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE and then what do I have to do to be sure that requests coming from clients outlook gets correctly handled, even if they're from random port? –  Pitto Jan 24 '12 at 12:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.