In large networks it's hard to enforce the requirement that users use a proxy server. Many people, after reinstalling their system, forget to reconfigure their browser. The solution to this issue is to force communication with web servers through a proxy server. To do this we need to have squid compiled with the option:'--enable-linux-netfilter'. The first step is to properly configure squid. For this we edit the file squid.conf. Depending on the version we're working with, we make the following modifications:

• Squid 2.5

httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_single_host off
httpd_accel_uses_host_header on
• Squid 2.6

http_port 3128 transparent

Now (assuming squid is listening, e.g., on port 3128 and is running on the computer acting as the network gateway - with eth1 being the internal interface) you add a simple rule to the firewall:
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128 If we have more internal interfaces and want Squid to work transparently on each of them, we add the rule below:
iptables -t nat -I PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 3128
Finally, we restart the firewall and squid, and we can enjoy a transparent proxy.