All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Julio Sánchez Fernández" <j_sanchez@stl.es>
To: Nerijus Baliunas <nerijus@users.sourceforge.net>
Cc: linux-kernel@vger.kernel.org
Subject: Re: Transparent proxies and binding to foreign addresses
Date: Wed, 01 Aug 2001 08:54:46 +0200	[thread overview]
Message-ID: <3B67A7B6.EE7B7931@stl.es> (raw)
In-Reply-To: <m2lmlcakrq.fsf@j-sanchez-p.stl.es> <m2lmlcakrq.fsf@j-sanchez-p.stl.es> <200107270215.EAA1376016@mail.takas.lt> <m2hevyaljp.fsf@j-sanchez-p.stl.es> <200107311820.UAA1709621@mail.takas.lt>



Nerijus Baliunas wrote:
> 
> On 27 Jul 2001 09:16:58 +0200 Julio Sanchez Fernandez <j_sanchez@stl.es> wrote:
> 
> JSF> And as long as you don't care what origin address the server sees,
> JSF> that's alright.  But all connections now seem to come from the proxy.
> JSF> And that does not let you do things like differentiated services,
> JSF> access control or audit.  Even user support becomes a mess.
> 
> Do you mean that even if I adapt them as you say, the receiving end will see
> connection orriginating from the proxy instead of the real address?

Precisely.  The bind-to-foreign-address will usually fail.  If you set
/proc/sys/net/ipv4/ip_nonlocal_bind to "1", then the bind will succeed but
when you connect it will fail immedaiately or not work (I have not checked
the exact behaviour and I am still digging in the code).

> I'm asking as these 2 port forwarders I tried work with 2.4 kernel in non-transparent
> mode, i.e. connections seem to come from the proxy, what I need is connection
> to be seen to come from real originating IP.

So do I.  If you are the daring type, I suggest you track the netfilter-devel
mail list (start from http://lists.samba.org/mailman/listinfo/netfilter-devel)
where some discussion has happened in July.  If you are not, I am afraid you
will have to stay at 2.2.x for the time being.

Julio

      parent reply	other threads:[~2001-08-01  6:59 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2001-07-25 19:09 Transparent proxies and binding to foreign addresses Julio Sanchez Fernandez
2001-07-27  2:15 ` Nerijus Baliunas
2001-07-26 19:41   ` Rob Landley
2001-07-27  7:16   ` Julio Sanchez Fernandez
2001-07-31 18:13     ` Nerijus Baliunas
     [not found]     ` <200107311820.UAA1709621@mail.takas.lt>
2001-08-01  6:54       ` Julio Sánchez Fernández [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=3B67A7B6.EE7B7931@stl.es \
    --to=j_sanchez@stl.es \
    --cc=linux-kernel@vger.kernel.org \
    --cc=nerijus@users.sourceforge.net \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.