linux router to connect kindle to proxy server

[tmcd0035]

Common probably and I'm sure I've solved this before at another school but for the life of me can't figure it out this time!

 

We have a private IP range routed on to our County's larger private IP range. Web request go through an onsite proxy server on port 1080 and are then forwarded to another Countywide proxy server before reaching the wider Internet.

 

We are looking at investing in either Kindles or Android tablets and are having problems with entering proxy settings, or the lack of support for these settings.

 

So the solution is to set up a router on our network to route traffic from a new private range onto our existing private range and in the process transparently redirect port 80 requests to our proxy server.

 

Hopefully that makes sense.

 

Here's what I've done:

 

Set up a Hyper-V virtual machine with two NICs and installed CentOS 6.1 i386 minimal. Eth0 is on our existing range (10.96.22.100) and eth1 is on the new range (172.16.20.1)

 

Here are router setting's I've tried:

#/etc/rc.local
modprobe ip_conntrack
modprobe iptable_nat

#/etc/sysctl.conf
echo 1 > /proc/sys/net/ipv4/ip_forward

#iptables
iptables --flush
iptables -t nat --flush
iptables --delete-chains
iptables -t nat --delete-chains

iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to 10.96.22.5:1080
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

iptables-save > /etc/sysconfig/iptables
service iptables stop
service iptables start
chkconfig iptables on
service iptables status

 

On the Kindle, the Android tab and my iPhone I've tried the following settings

Static IP: 172.16.20.5
Netmask:  255.255.0.0
Gateway:  172.16.20.1
DNS:        10.96.22.11

 

Can anyone point me in the right direction to get this working?

 

Thanks

 

Terry.

[browolf]

Not sure if this helps but

the iptables transparency command we use is

 

-A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128

 

but what we've done is make a separate transparent proxy that handles guest wireless and everything: iptables, squid, dns, dhcp is on one box so it's an isolated system. the two lan cards one is vlan for guest wireless, the other plugs into the router than connects to county.

[tmcd0035]

 

-A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128

 

 

The problem with that is it redirects the port but there is no mention of where the proxy server is.

 

can i do something like

 

 REDIRECT --to 10.96.22.5 --to-ports 1080

 

?

 

I can't help feeling I'm missing something obvious in my original script.

[browolf]

In our case it assumes the proxy is on the same machine. which is it.

 

if we had the proxy on another machine we'd do it in the form

 

iptables -t nat -A PREROUTING -p PROTO -d DEST_IP --dport DEST_PORT

-j REDIRECT --to-ports LOCAL_PORTS

 

this page looks relevant to your issues: http://www.karlrupp.net/en/computer/nat_tutorial

 

i'd forget the transparency to begin with and get it working with a laptop

Edited February 2, 2012 by browolf