Пытаюсь настроить прозрачный прокси. Почитал гайды, вроде настроил, но не работает, интерфейсы пингуются. Прошу помочь в настройке. Прикладываю настройки squid, лог работы, настройки интерфейсов.
squid.conf
#Разрешаем доступ из своей сети
acl localnet src 10.86.0.0/24
acl localnet src 192.168.0.0/24
#Набор правил для доступа
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
# HTTP доступ
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow localhost
http_access deny all
# Порт и IP-адрес сервера
http_port 3128 intercept
http_port 192.168.2.1:3128 transparent
# Допустимый обьем памяти ОЗУ
cache_mem 1024 MB
# Максимальный и минимальный размер кэшируемого файла
maximum_object_size_in_memory 512 KB
maximum_object_size 4 MB
# Директория кэша и размер
cache_dir ufs /var/spool/squid 2048 16 256
# Делаем прокси анонимным
via off
forwarded for delete
interfaces
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
source /etc/network/interfaces.d/*
# The loopback network interface
auto lo
iface lo inet loopback
# WAN Interface
auto enp3s2
iface enp3s2 inet static
address 10.86.0.18
netmask 255.255.255.0
gateway 192.168.0.1
# LAN Interface
auto enp1s0
iface enp1s0 inet static
address 192.168.2.1
netmask 255.255.255.0
post -up /etc/nat
nat
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -A INPUT -i lo -j ACCEPT
iptables -A FORWARD -i enp1s0 -o enp3s2 -j ACCEPT
iptables -t nat -A POSTROUTING -o enp3s2 -s 10.86.0.0/24 -j MASQUERADE
iptables -A FORWARD -i enp3s2 -m state --state ESTABLISHED, RELATED -j ACCEPT
iptables -A FORWARD -i enp3s2 -o enp1s0 -j REJECT
iptables -t nat -A PREROUTING -i enp1s0 ! -d 10.86.0.0/24 -p tcp -m multiport --dport 80,8080 -j DNAT --to 192.168.2.1:3128
log
2016/09/20 16:22:56 kid1| Adaptation support is off.
2016/09/20 16:22:56 kid1| Accepting NAT intercepted HTTP Socket connections at local=[::]:3128 remote=[::] FD 17 flags=41
2016/09/20 16:22:56 kid1| Done reading /var/spool/squid swaplog (0 entries)
2016/09/20 16:22:56 kid1| Store rebuilding is 0.00% complete
2016/09/20 16:22:56 kid1| Finished rebuilding storage from disk.
2016/09/20 16:22:56 kid1| 0 Entries scanned
2016/09/20 16:22:56 kid1| 0 Invalid entries.
2016/09/20 16:22:56 kid1| 0 With invalid flags.
2016/09/20 16:22:56 kid1| 0 Objects loaded.
2016/09/20 16:22:56 kid1| 0 Objects expired.
2016/09/20 16:22:56 kid1| 0 Objects cancelled.
2016/09/20 16:22:56 kid1| 0 Duplicate URLs purged.
2016/09/20 16:22:56 kid1| 0 Swapfile clashes avoided.
2016/09/20 16:22:56 kid1| Took 0.06 seconds ( 0.00 objects/sec).
2016/09/20 16:22:56 kid1| Beginning Validation Procedure
2016/09/20 16:22:56| pinger: Initialising ICMP pinger ...
2016/09/20 16:22:56| pinger: ICMP socket opened.
2016/09/20 16:22:56| pinger: ICMPv6 socket opened
2016/09/20 16:22:56 kid1| Completed Validation Procedure
2016/09/20 16:22:56 kid1| Validated 0 Entries
2016/09/20 16:22:56 kid1| store_swap_size = 0.00 KB
2016/09/20 16:22:56 kid1| ERROR: No forward-proxy ports configured.
2016/09/20 16:22:57 kid1| storeLateRelease: released 0 objects
2016/09/20 16:32:52 kid1| ERROR: NF getsockopt(ORIGINAL_DST) failed on local=192.168.2.1:3128 remote=192.168.2.24:57805 FD 12 flags$
2016/09/20 16:32:52 kid1| ERROR: NAT/TPROXY lookup failed to locate original IPs on local=192.168.2.1:3128 remote=192.168.2.24:5780$
2016/09/20 16:32:52 kid1| ERROR: NF getsockopt(ORIGINAL_DST) failed on local=192.168.2.1:3128 remote=192.168.2.24:57807 FD 12 flags$
2016/09/20 16:32:52 kid1| ERROR: NAT/TPROXY lookup failed to locate original IPs on local=192.168.2.1:3128 remote=192.168.2.24:5780$
2016/09/20 16:32:52 kid1| ERROR: NF getsockopt(ORIGINAL_DST) failed on local=192.168.2.1:3128 remote=192.168.2.24:57809 FD 12 flags$
2016/09/20 16:32:52 kid1| ERROR: NAT/TPROXY lookup failed to locate original IPs on local=192.168.2.1:3128 remote=192.168.2.24:5780$
2016/09/20 16:32:52 kid1| ERROR: NF getsockopt(ORIGINAL_DST) failed on local=192.168.2.1:3128 remote=192.168.2.24:57811 FD 12 flags$
2016/09/20 16:32:52 kid1| ERROR: NAT/TPROXY lookup failed to locate original IPs on local=192.168.2.1:3128 remote=192.168.2.24:5781$
2016/09/20 16:33:12 kid1| ERROR: NF getsockopt(ORIGINAL_DST) failed on local=192.168.2.1:3128 remote=192.168.2.24:57880 FD 12 flags$
2016/09/20 16:33:12 kid1| ERROR: NAT/TPROXY lookup failed to locate original IPs on local=192.168.2.1:3128 remote=192.168.2.24:5788$
2016/09/20 16:33:12 kid1| ERROR: NF getsockopt(ORIGINAL_DST) failed on local=192.168.2.1:3128 remote=192.168.2.24:57879 FD 12 flags$
2016/09/20 16:33:12 kid1| ERROR: NAT/TPROXY lookup failed to locate original IPs on local=192.168.2.1:3128 remote=192.168.2.24:5787$
2016/09/20 16:33:12 kid1| ERROR: NF getsockopt(ORIGINAL_DST) failed on local=192.168.2.1:3128 remote=192.168.2.24:57882 FD 12 flags$
2016/09/20 16:33:12 kid1| ERROR: NAT/TPROXY lookup failed to locate original IPs on local=192.168.2.1:3128 remote=192.168.2.24:5788$
2016/09/20 16:33:12 kid1| ERROR: NF getsockopt(ORIGINAL_DST) failed on local=192.168.2.1:3128 remote=192.168.2.24:57884 FD 12 flags$
2016/09/20 16:33:12 kid1| ERROR: NAT/TPROXY lookup failed to locate original IPs on local=192.168.2.1:3128 remote=192.168.2.24:5788$
2016/09/20 16:33:17 kid1| ERROR: NAT/TPROXY lookup failed to locate original IPs on local=192.168.2.1:3128 remote=192.168.2.24:5788$
2016/09/20 16:33:23 kid1| ERROR: NF getsockopt(ORIGINAL_DST) failed on local=192.168.2.1:3128 remote=192.168.2.24:57888 FD 12 flags$
2016/09/20 16:33:23 kid1| ERROR: NAT/TPROXY lookup failed to locate original IPs on local=192.168.2.1:3128 remote=192.168.2.24:5788$
2016/09/20 16:33:38 kid1| ERROR: NF getsockopt(ORIGINAL_DST) failed on local=10.86.0.18:3128 remote=10.86.0.24:57891 FD 12 flags=33$
2016/09/20 16:33:38 kid1| ERROR: NAT/TPROXY lookup failed to locate original IPs on local=10.86.0.18:3128 remote=10.86.0.24:57891 F$
2016/09/20 16:33:38 kid1| ERROR: NF getsockopt(ORIGINAL_DST) failed on local=10.86.0.18:3128 remote=10.86.0.24:57892 FD 12 flags=33$
2016/09/20 16:33:38 kid1| ERROR: NAT/TPROXY lookup failed to locate original IPs on local=10.86.0.18:3128 remote=10.86.0.24:57892 F$
2016/09/20 16:33:38 kid1| ERROR: NF getsockopt(ORIGINAL_DST) failed on local=10.86.0.18:3128 remote=10.86.0.24:57894 FD 12 flags=33$
2016/09/20 16:33:38 kid1| ERROR: NAT/TPROXY lookup failed to locate original IPs on local=10.86.0.18:3128 remote=10.86.0.24:57894 F$
2016/09/20 16:33:39 kid1| ERROR: NF getsockopt(ORIGINAL_DST) failed on local=10.86.0.18:3128 remote=10.86.0.24:57896 FD 12 flags=33$
2016/09/20 16:33:39 kid1| ERROR: NAT/TPROXY lookup failed to locate original IPs on local=10.86.0.18:3128 remote=10.86.0.24:57896 F$
2016/09/20 16:33:44 kid1| ERROR: NF getsockopt(ORIGINAL_DST) failed on local=10.86.0.18:3128 remote=10.86.0.24:57900 FD 12 flags=33$
2016/09/20 16:33:44 kid1| ERROR: NAT/TPROXY lookup failed to locate original IPs on local=10.86.0.18:3128 remote=10.86.0.24:57900 F$
2016/09/20 16:36:23 kid1| Preparing for shutdown after 0 requests
2016/09/20 16:36:23 kid1| Waiting 30 seconds for active connections to finish
2016/09/20 16:36:23 kid1| Closing HTTP port [::]:3128
2016/09/20 16:36:23 kid1| Closing HTTP port 192.168.2.1:3128
2016/09/20 16:36:23 kid1| Closing Pinger socket on FD 20
2016/09/20 16:36:37| Pinger exiting.
2016/09/20 16:36:54 kid1| Shutdown: NTLM authentication.
2016/09/20 16:36:54 kid1| Shutdown: Negotiate authentication.
2016/09/20 16:36:54 kid1| Shutdown: Digest authentication.
2016/09/20 16:36:54 kid1| Shutdown: Basic authentication.
2016/09/20 16:36:54 kid1| Shutting down...
2016/09/20 16:36:54 kid1| Closing unlinkd pipe on FD 14
2016/09/20 16:36:54 kid1| storeDirWriteCleanLogs: Starting...
2016/09/20 16:36:54 kid1| Finished. Wrote 0 entries.
2016/09/20 16:36:54 kid1| Took 0.00 seconds ( 0.00 entries/sec).
CPU Usage: 0.120 seconds = 0.056 user + 0.064 sys
Maximum Resident Size: 108768 KB
Page faults with physical i/o: 1
2016/09/20 16:36:54 kid1| Logfile: closing log daemon:/var/log/squid/access.log
2016/09/20 16:36:54 kid1| Logfile Daemon: closing log daemon:/var/log/squid/access.log
2016/09/20 16:36:54 kid1| Open FD UNSTARTED 6 DNS Socket IPv6
2016/09/20 16:36:54 kid1| Open FD UNSTARTED 8 DNS Socket IPv4
2016/09/20 16:36:54 kid1| Open FD UNSTARTED 9 IPC UNIX STREAM Parent
2016/09/20 16:36:54 kid1| Squid Cache (Version 3.5.12): Exiting normally.
На момент настройки, оборудование размещается так:
