Join Log in
Score:0
ogbofjnr avatar Server

How to redirect traffic from squid to vpn?

cn flag
ogbofjnr

I have a windows machine with a squid server and VPN client connection(which is not the default gateway)

What I want is to redirect some traffic from squid to my default ethernet connection and some to VPN.

Ethernet adapter Ethernet:

   Connection-specific DNS Suffix  . :
   IPv4 Address. . . . . . . . . . . : 192.168.100.11
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.100.1

PPP adapter vpn_conn:

   Connection-specific DNS Suffix  . :
   IPv4 Address. . . . . . . . . . . : 172.16.3.33
   Subnet Mask . . . . . . . . . . . : 255.255.255.255
   Default Gateway . . . . . . . . . :

squid conf

http_port 2003
acl  user3_acl  myport 2003
tcp_outgoing_address 172.16.3.33 user3_acl

http_port 2004
acl  user4_acl  myport 2004

2004 port works as expected through my Ethernet adapter, but redirect to vpn doesn't work,

the log contains

1638648992.630     75 33.33.333.333 NONE/503 0 CONNECT docs.microsoft.com:443 - HIER_NONE/- -
190
0 + 0
vpn
in flag
NiKiZe
You will still need a route on the VPN interface so that any outgoing traffic has a destination, but with a high metric it should not be used by anything by default
1
Reply
ogbofjnr avatar
cn flag
ogbofjnr
Thank you, it's true. I've managed to solve it with `route add 0.0.0.0 mask 0.0.0.0 172.16.3.33`. But can you explain to me how it works? As far as I understand tcp_outgoing_address should send traffic to VPN link, and then it will be routed further. Why do I need to specify an additional route?
0
Reply
in flag
NiKiZe
It wants to go out on that interface yes, but where should the traffic go, it has no route other than that network. So what should it do to reach something like 8.8.8.8 ?
0
Reply
Score:1
avatar Server
in flag
NiKiZe

It still needs a route on the VPN interface so that any outgoing traffic has a destination, but with a high metric it should not be used by anything by default.

Since it is link on 172.16.3.33 it knows how to reach that and the peer, but nothing else, so it will be unreachable.

Now adding that route allows it to know where to go for any other traffic. There might be an additional step needed, and that is for the other side to know how the traffic will find its way back, but since you are using proxy with local source, that will be mostly covered.

0 + 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.