0

I am trying to setup a public squid proxy that routes it's traffic via a VPN server elsewhere in the world. It's running inside a docker container on a VPS host.

Using the default settings with push gateway, I can access the squidproxy on the VPS itself and it does route it's traffic via the vpn.

However, no external IPs can access the squid proxy. I do have docker forwarding the port 3128:3128.

It is something to do with the OpenVPN routes that are created (as the Squid proxy is accessible until OpenVPN starts)

I found it is this route that seems to "block" my external traffic.

128.0.0.0/1 via 10.91.10.5 dev tun0

(10.91.10.5 is the gateway of the VPN)

If I remove it I can access squid again but then outgoing requests don't use the VPN.

I can make my external IP work by explicitly adding it like so

ip route add 203.X.X.X via 172.18.0.1 dev eth0

(172.18.0.1 is the docker gateway)

But I need it to work with any external IPs.

I have tried ip route add 0.0.0.0 via 172.18.0.1 dev eth0.

But this doesn't work as 128.0.0.0/1 is more specific so matches first.

In conclusion

1) Need any IP to access the SquidProxy (port 3128)

2) Need all outgoing SquidProxy requests (80,443) to go via the VPN

Any help would be greatly appreciated!

Matt H.
  • 31
  • 6

1 Answers1

0

UPDATE:

So I have this working

1) Start OpenVPN with the below command

openvpn --route-nopull --script-security 2 --up /etc/openvpn/up.sh

This disables it from setting up the VPN routes. So all traffic in and out is using the default route not via VPN

2) In the up.sh, I run the below commands

#!/bin/sh

/sbin/ip route add 0.0.0.0/0 dev $1 table 100
/sbin/ip rule add from all fwmark 1 table 100

/sbin/iptables -A OUTPUT -t mangle -p tcp -m multiport --dports 80,443 -j MARK --set-mark 1
/sbin/iptables -t nat -A POSTROUTING -o $1 -j MASQUERADE

I have then setup Squid to only allow ports 80 & 443. Docker has port 3128 open for access to the container.

I also needed to use --sysctl net.ipv4.conf.all.rp_filter=0 in the docker run command.

Matt H.
  • 31
  • 6