How to setup Transparent Proxy for JUST port 80 with L3 core switch.

[bumlardy]

Our setup is that we have 4 vlans and a layer 3 core switch (Procurve 6600 J9264a) set as the default gateway for the different subnets. Everything is working great so long as we're happy entering our upstream proxy details into the browser settings (either automatically on domain joined PCs, automatically on DHCP assigned devices that read the wpad settings and have their browsers set to auto proxy config or manually by physically entering the name and port)

 

As I mentioned our core switch is the default gateway to all the clients, what I THINK I want to do is to change the default gateway on the core switch, so that instead of forwarding request onto the ISP supplied router that needs the proxy for port 80, it goes to a device acting as a transparent proxy for port 80 but that passes ALL other traffic through to the router. If we don't enter proxy settings any app or service that doesn't need port 80 works fine.

 

The problem I have is (I don't know what I'm doing mainly) that I cant seem to find a FREE software setup that accepts the traffic from the 4 different subnets we have.

 

Lets say we have 10.10.1.0/22 10.10.2.0/22 192.168.1.0/22

 

If I was to use a device such as an IPCOP/IPFIRE/PFSENSE/SMOOTHWALL etc. How do I configure it to accept traffic from the different subnets. They generally have a green and red design. I would also be happy to just use squid and a basic linux build. An abundance of old server hardware is available so that is not an issue but I am trying to do it without paying for software.

 

Given our core switch ROUTES I figured I could just hang a device on any FREE IP address (lets say 10.10.1.2) set is as the DGW for the core switch and then in the device have ITS DGW as the original ISP supplied ROUTER which would be routed back via the core switch. I don't think I need to physically cable the new intermediate device in the space between core switch and ISP router....

 

For our BYOD Wifi STAFF network I have put a transparent proxy in place and then set ITS address in one of our scopes in DHCP as the DGW for the visitors network, because it's not the L3 switch that's the DGW in this situation it is of course not possible to route back into the rest of the network.

 

I don't know if this is clear at all!??

 

If anyone can offer any help I'll try and provide some clearer details...

[ReBoot]

I guess this might work. You will need to ensure your transparent proxy is set up with a cache_peer for the upstream proxy or squid is going to assume its connected directly to the internet and not behind a proxy.

 

Squid can accept traffic from different subnets using the ACLs in squid.conf. How you get the traffic forwarded to the squid box is another matter. Setting the DGW on a L3 switch is one approach. You could have multiple NICs on the squid box connected to your VLANs or maybe a single trunked port with multiple logical interfaces.

 

I might investigate how the proxy settings could be configured on your non-compliant devices before going to all this trouble !