<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
                 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd">
<!-- For license information see sanewall-manual-info.xml.in -->
<refentry id="helpconf-proxy">

<refmeta>
<refentrytitle>transparent_proxy, transparent_squid helpers: sanewall-transparent_proxy</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>

<refnamediv>
<refdescriptor>sanewall-transparent_proxy</refdescriptor>
<refname>sanewall-transparent_proxy</refname>
<refname>sanewall-transparent_squid</refname>
<refpurpose>set up a transparent proxy</refpurpose>
</refnamediv>

<refsynopsisdiv>
  <cmdsynopsis>
    <command>transparent_proxy</command>
    <arg choice="plain"><replaceable>service</replaceable></arg>
    <arg choice="plain"><replaceable>port</replaceable></arg>
    <arg choice="plain"><replaceable>user</replaceable></arg>
    <arg choice="opt"><replaceable>rule-params</replaceable></arg>
  </cmdsynopsis>
  <cmdsynopsis>
    <command>transparent_squid</command>
    <arg choice="plain"><replaceable>port</replaceable></arg>
    <arg choice="plain"><replaceable>user</replaceable></arg>
    <arg choice="opt"><replaceable>rule-params</replaceable></arg>
  </cmdsynopsis>
</refsynopsisdiv>

<refsect1><title>Description</title>
  <para>
    The <command>transparent_proxy</command> helper command sets up
    transparent caching for TCP traffic.
  </para>
  <note><para>
    The proxy application must be running on the
    firewall host at port <replaceable>port</replaceable> with the
    credentials of the local user <replaceable>user</replaceable> (which
    may be a space-delimited list enclosed in quotes) serving requests
    appropriate to the TCP port <replaceable>service</replaceable>.
  </para></note>
  <para>
    The <option><replaceable>rule-params</replaceable></option> define
    a set of rule parameters to define the traffic that is to be
    proxied. See <xref linkend="rule-params"/> for more details.
  </para>
  <para>
    For traffic destined for the firewall host or passing
    through the firewall, do not use the <option>outface</option>
    rule because the rules are applied before the routing decision and
    so the outgoing interface will not be known.
  </para>
  <para>
    An empty <replaceable>user</replaceable> string ("") disables
    caching of locally-generated traffic. Otherwise, traffic starting
    from the firewall is captured, except traffic generated by
    the local user(s) <replaceable>user</replaceable>.
    The <option>inface</option>, <option>outface</option> and
    <option>src</option> <replaceable>rule-params</replaceable> are all
    ignored for locally-generated traffic.
  </para>
  <para>
    The <command>transparent_squid</command> helper command sets up
    the special case for HTTP traffic with <replaceable>service</replaceable>
    implicitly set to 80.
  </para>
</refsect1>

<refsect1><title>Examples</title>
  <programlisting>
transparent_proxy 80 3128 squid inface eth0 src 192.0.2.0/24
transparent_squid 3128 squid inface eth0 src 192.0.2.0/24

transparent_proxy "80 3128 8080" 3128 "squid privoxy root bin" \
  inface not "ppp+ ipsec+" dst not "a.not.proxied.server"
transparent_squid "80 3128 8080" "squid privoxy root bin" \
  inface not "ppp+ ipsec+" dst not "non.proxied.server"
  </programlisting>
</refsect1>

<refsect1><title>See Also</title>
  <simplelist type="vert">
    <member><xref linkend="sanewall"/></member>
    <member><xref linkend="sanewall.conf"/></member>
    <member><xref linkend="def-interface"/></member>
    <member><xref linkend="def-router"/></member>
  </simplelist>
</refsect1>

</refentry>
