2

I'm running Ubuntu 16.04.2 LTS and Docker 17.05.0-ce behind a company proxy with credentials.

My goal is to create a transparent proxy in docker container so that I don't need anymore to configure the proxy in environment variables, config files... and change the password each month without forgetting one in all those configs.

First step : I create an image with that Dockerfile

FROM ubuntu:16.04
COPY apt.conf /etc/apt/
RUN apt-get update && \
    apt-get upgrade -y && \
    apt-get install squid -y
RUN rm -f /etc/apt/apt.conf
COPY squid.conf /etc/squid3/squid.conf
COPY entrypoint.sh /sbin/entrypoint.sh
RUN chmod 755 /sbin/entrypoint.sh
EXPOSE 3128/tcp
ENTRYPOINT ["/sbin/entrypoint.sh"]

and that squid.conf

http_access allow all
http_port 3128 intercept
cache_peer x.x.x.x parent 8080 0 default no-query login=yyy:zzz
never_direct allow all

Then

docker build -t squid .
docker run --rm -d -p 3128:3128 --name squid squid

Now if I do

export http_proxy=localhost:3128
curl www.google.be

It's working fine.

So the next step would be to make it transparent.

I tried with that (inspired from https://www.stux6.net/unix/linux/proxy-transparent-linux-squid)

unset http_proxy
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
curl www.google.be

But it's not working anymore. What can I do ?

On my machine

br-4986226181db Link encap:Ethernet  HWaddr ...
      inet addr:...  Bcast:0.0.0.0  Mask:255.255.0.0
      UP BROADCAST MULTICAST  MTU:1500  Metric:1
      RX packets:0 errors:0 dropped:0 overruns:0 frame:0
      TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:0
      RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

br-5699616a00fb Link encap:Ethernet  HWaddr ...
      inet addr:...  Bcast:0.0.0.0  Mask:255.255.0.0
      UP BROADCAST MULTICAST  MTU:1500  Metric:1
      RX packets:0 errors:0 dropped:0 overruns:0 frame:0
      TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:0
      RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

docker0   Link encap:Ethernet  HWaddr ...
      inet addr:172.17.0.1  Bcast:0.0.0.0  Mask:255.255.0.0
      inet6 addr: ... Scope:Link
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
      RX packets:16908 errors:0 dropped:0 overruns:0 frame:0
      TX packets:33405 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:0
      RX bytes:934408 (934.4 KB)  TX bytes:47533855 (47.5 MB)

eth0      Link encap:Ethernet  HWaddr ...
      inet addr:...  Bcast:...  Mask:255.255.255.0
      inet6 addr: ... Scope:Link
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
      RX packets:1827743 errors:0 dropped:0 overruns:0 frame:0
      TX packets:1131003 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:1000
      RX bytes:209300815 (209.3 MB)  TX bytes:91477854 (91.4 MB)
      Interrupt:16

lo        Link encap:Local Loopback
      inet addr:127.0.0.1  Mask:255.0.0.0
      inet6 addr: ::1/128 Scope:Host
      UP LOOPBACK RUNNING  MTU:65536  Metric:1
      RX packets:4141231 errors:0 dropped:0 overruns:0 frame:0
      TX packets:4141231 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:1
      RX bytes:311258498 (311.2 MB)  TX bytes:311258498 (311.2 MB)

veth8b546f1 Link encap:Ethernet  HWaddr ...
      inet6 addr: ... Scope:Link
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
      RX packets:36 errors:0 dropped:0 overruns:0 frame:0
      TX packets:65 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:0
      RX bytes:16414 (16.4 KB)  TX bytes:20798 (20.7 KB)

veth8b546f1 appears after starting the container.

and (before adding the rule)

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
DOCKER     all  --  anywhere             anywhere             ADDRTYPE match dst-type LOCAL

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
DOCKER     all  --  anywhere            !127.0.0.0/8          ADDRTYPE match dst-type LOCAL

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  172.17.0.0/16        anywhere
MASQUERADE  all  --  172.18.0.0/16        anywhere
MASQUERADE  all  --  172.19.0.0/16        anywhere
MASQUERADE  tcp  --  172.17.0.2           172.17.0.2           tcp dpt:3128

Chain DOCKER (2 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere
RETURN     all  --  anywhere             anywhere
RETURN     all  --  anywhere             anywhere
DNAT       tcp  --  anywhere             anywhere             tcp dpt:3128 to:172.17.0.2:3128

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.