firehol-proxy(5)

📦
version 3.1.8 · 4 versions
, in debian trixie, ubuntu resolute, ubuntu stonking

💖 firehol-proxy — set up a transparent TCP, HTTP or squid proxy 💖

okay bestie, gather round, because this is the firehol-proxy page from the FireHOL manual (section 5, we love a section 5) and it's literally about making a transparent proxy happen. no cap, it's giving networking main character energy. 🦋

✨ SYNOPSIS ✨

transparent_proxy service port user rule-params

transparent_squid port user rule-params

🌸 DESCRIPTION 🌸

so the transparent_proxy helper command sets up transparent caching for TCP traffic. that's the whole vibe. 🎀

and the transparent_squid helper command? it sets up the special case for HTTP traffic, with service implicitly set to 80. it just knows. iykyk. 💅

Note — the proxy application has to be running on the firewall host at port port, with the credentials of the local user user (and psst, user can be a space-delimited list, just wrap it in quotes), serving requests appropriate to the TCP port service. that's non-negotiable, fr fr. 🙈

the rule-params define a set of rule parameters that decide which traffic is gonna get proxied. for more details go read firehol-params(5), she explains everything. 👑

now for the important part. for traffic destined for the firewall host, or traffic just passing through the firewall, do not use the outface parameter, because the rules get applied before the routing decision, which means the outgoing interface isn't known yet. it's giving "we haven't decided yet bestie". 😭

an empty user string ("") disables caching of locally-generated traffic. otherwise, traffic starting from the firewall gets captured — except traffic generated by the local user(s) user. and heads up: the inface, outface and src rule-params are all ignored for locally-generated traffic. all three. ignored. periodt. 💀

🌈 EXAMPLES 🌈

okay these are so clean, look:

transparent_proxy 80 3128 squid inface eth0 src 192.0.2.0/24
transparent_squid 3128 squid inface eth0 src 192.0.2.0/24

transparent_proxy "80 3128 8080" 3128 "squid privoxy root bin" \
      inface not "ppp+ ipsec+" dst not "a.not.proxied.server"
transparent_squid "80 3128 8080" "squid privoxy root bin" \
      inface not "ppp+ ipsec+" dst not "non.proxied.server"

see how the user list gets quoted? "squid privoxy root bin"? yeah. iconic. 🫶

🦋 SEE ALSO 🦋

👑 AUTHORS 👑

FireHOL Team. that's the whole team. respect. 💅

and that's the page bestie!! this was the FireHOL Reference, Built 13 Apr 2025, version 3.1.8 — mwah, go set up that proxy, you're gonna eat. 🍓🧚💜

📦 where this page comes from