Gfilui

I have an ubuntu proxy running server 16.04, squid 3.5.12 and NCSA. The server has two NICs, one connected to internet router, eno1 with IP 192.168.1.2/24 and another connected to client LAN, eno2 with IP 192.168.2.1/24. When I configure proxy settings on client machine, the browser requests login credentials but when I choose auto detect proxy settings, the user browses internet with nothing even being captured in access.log. Primarily, I want users who bypass proxy settings not to be able to browse internet, that's number one objective. Here is my priority list:

1. All client users must be authenticated when browsing internet – username and password (a must)


2. Users who bypass proxy settings on their browser must not browse internet (a must)

NB: ASSIST ME WITH OBJECTIVE 2

In terms of iptables, I really have nothing and would be happy if any person who chooses to explain do so bearing in mind that I am running Ubuntu 16.04. I now know how to save iptables but to have the ones that can achieve my objective is the main problem. I have literally commented out everything I had done in rc.local as it is not achieving anything.

auto lo
iface lo inet loopback

# Gre tunnel interface
#auto wccp0
#iface wccp0 inet manual
# pre-up ip tunnel add wccp0 gre remote 10.10.101.2 local 192.168.0.4 dev eno1 ttl 255

# The primary network interface
auto eno1
iface eno1 inet static
 address 192.168.1.2
 netmask 255.255.255.0
 network 192.168.1.0
 broadcast 192.168.1.255
 gateway 192.168.1.1
 # dns-* options are implemented by the resolvconf package, if installed
 dns-nameservers 192.168.0.5
 dns-search hit.ac.zw

#Secondary interface
auto eno2
iface eno2 inet static
 address 192.168.2.1
 netmask 255.255.255.0
 network 192.168.2.0
 gateway 192.168.2.1
#save ip tables
pre-up iptables-restore < /etc/iptables.up.rules

Squid configuration:

auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwd
auth_param basic children 5
auth_param basic realm Systems Admin
auth_param basic credentialsttl 2 hours
auth_param basic casesensitive off
acl blocked_sites url_regex -i "/etc/squid/blocked_sites"
acl ncsa_users proxy_auth REQUIRED

#acl blocked_sites url_regex -i "/etc/squid/blocked_sites"
acl localnet src 192.168.1.0/24
acl localnet src 192.168.2.0/24
#acl lan src 192.168.1.0/24

acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT

http_port 3128

http_access deny !ncsa_users
http_access deny ncsa_users blocked_sites

#http_access deny blocked_sites
# Deny requests to certain unsafe ports
http_access deny !Safe_ports
#http_access deny localnet
#http_access deny lan
# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports

# Only allow cachemgr access from localhost
http_access allow localhost manager
http_access deny manager

IP-tables:

#MY IPTABLE - it has been changed several times i no longer have original
 *filter
:INPUT ACCEPT [231:24245]
:FORWARD ACCEPT [205:45205]
:OUTPUT ACCEPT [155:73325]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A FORWARD -s 192.168.2.1/24 -p tcp -m tcp --dport 3128 -j ACCEPT
-A FORWARD -s 192.168.2.0/24 -j REJECT --reject-with icmp-port-unreachable
COMMIT
*nat
:PREROUTING ACCEPT [1001:61764]
:INPUT ACCEPT [211:12736]
:OUTPUT ACCEPT [10:814]
:POSTROUTING ACCEPT [719:45963]
-A PREROUTING -i eno2 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
-A PREROUTING -i eno1 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.1.2:3128
COMMIT

Routing table:

root@proxy:~# route -n
 Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eno1
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eno1
192.168.2.0 0.0.0.0 255.255.255.0 U 0 0 0 eno2

Route Print From Client Machine

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
 0.0.0.0 0.0.0.0 192.168.2.1 192.168.2.2 276
 127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
 127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
 127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
 192.168.2.0 255.255.255.0 On-link 192.168.2.2 276
 192.168.2.2 255.255.255.255 On-link 192.168.2.2 276
 192.168.2.255 255.255.255.255 On-link 192.168.2.2 276
 224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
 224.0.0.0 240.0.0.0 On-link 192.168.2.2 276
 255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
 255.255.255.255 255.255.255.255 On-link 192.168.2.2 276
===========================================================================
Persistent Routes:
 Network Address Netmask Gateway Address Metric
 0.0.0.0 0.0.0.0 192.168.2.1 Default
===========================================================================

enter image description here