[Q] Some newbie questions.....

[Q] Some newbie questions.....

[Donovan J. Edye]

[-- Attachment #1: Type: text/plain, Size: 1114 bytes --]

G'Day,

I have the following setup: CAPS = Device / Machine

-	ROUTER: WAN Address: xxxxxxxxx LAN Address: 192.168.40.1
-	IPTABLES: 1 LAN Interface 192.168.40.5 (Gateway: 192.168.40.1)
-	PROXY: 1 LAN Interface 192.168.40.10 (Gateway: 192.168.40.5)

I have a number of other machines also on the 192.168.40/24 network who all
have their GW set to 192.168.40.5. What I want NETFILTER to do is the
following:

-	Have a transparent proxy such that any port 80 connections from
these machines get processed by PROXY on port 3128
-	Allow all established connections from these machines to be allowed
out via 192.168.40.1 otherwise disallowed
-	IPTABLES to do no NAT as that is already being done by ROUTER

Can anyone help me with some sample rules to get going?

TIA

--Donovan 
Web: http://www.edye.wattle.id.au <http://www.edye.wattle.id.au/> 
----------------------------------------------------------------------
SetiStats - Get your SETI statistics delivered to your mailbox daily.
http://www.edye.wattle.id.au/p.php?page=/delphi/setistats
---------------------------------------------------------------------- 



[-- Attachment #2: winmail.dat --]
[-- Type: application/ms-tnef, Size: 5892 bytes --]

Re: [Q] Some newbie questions.....

[Rob Sterenborg]

> I have the following setup: CAPS = Device / Machine
>
> - ROUTER: WAN Address: xxxxxxxxx LAN Address: 192.168.40.1
> - IPTABLES: 1 LAN Interface 192.168.40.5 (Gateway: 192.168.40.1)
> - PROXY: 1 LAN Interface 192.168.40.10 (Gateway: 192.168.40.5)

These only have 1 interface each ?
Are you connecting all the machines (clients too) to a hub or switch ?

> I have a number of other machines also on the 192.168.40/24 network who
all
> have their GW set to 192.168.40.5. What I want NETFILTER to do is the
> following:
>
> - Have a transparent proxy such that any port 80 connections from
> these machines get processed by PROXY on port 3128

If iptables is not doing NAT, then what is it for with 1 NIC ?
You could as well set the default gateway of the workstations to
192.168.40.1 and configure the webbrowsers to use the proxy at
192.168.40.10. So you can skip the iptables box.

Anyway, not sure if it will work but you can try this :

iptables -P FORWARD DROP
iptables -A FORWARD -m state --state RELATED,ESTABLISHED \
  -j ACCEPT
iptables -A FORWARD -s 192.168.40.0/24 -d 192.168.40.10 -p tcp \
  --dport 3128 -j ACCEPT
iptables -t nat -A PREROUTING -s 192.168.40.0/24 -p tcp \
  --dport 80 -j DNAT --to-destination 192.168.40.10:3128
echo 1 > /proc/sys/net/ipv4/ip_forward

> - Allow all established connections from these machines to be allowed
> out via 192.168.40.1 otherwise disallowed
> - IPTABLES to do no NAT as that is already being done by ROUTER

Don't use any SNAT/MASQUERADE rules. Then it won't NAT.


Gr,
Rob