I'm trying to redirect all of my subnet traffic to a squid proxy using iptables on the router gateway (the squid proxy is located in the LAN).

The redirection works (cache & access file respond well), but the requested page page shows an error (image is attached)

Squid version:3.5.27 The iptables lines that we used for the redirection: - the squid box port+IP. - the router's IP.


  1. iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination

  2. iptables -t nat -A POSTROUTING -p tcp -d --dport 3129 -j SNAT --to-source


These are the lines that we have changed/added to the squid.conf:

acl localnet src

http_access allow localnet 
http_port 3129 

error img I can't figure it out where is the problem (iptables or squid.conf file). Thank you in advance. Chat Conversation End Type a message...

1 Answer 1


It seems you are trying to configure a transparent proxy, so I guess you just miss the transparent argument to your http_proxy settings. Modify the line with the following syntax:

http_port 3128 transparent

Restart the service and try again.

  • I added this to my config file also added another forward proxy port (3128), got this errors in the cache.log file: NF getsockopt(ORIGINAL_DST) failed on local= NAT/TPROXY lookup failed to locate original IPs on local= and the browser shows ERR_EMPTY_RESPONSE
    – zo_av
    Aug 27, 2018 at 10:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.