Re: Transparent Remote Proxy Server

[Aleksandar Milivojevic <amilivojevic@pbl.ca>]

ms419@freezone.co.uk wrote:
> Thank you sincerely for your suggestion! You are correct: It is simpler 
> to use DNAT & MASQUERADE. I tried it & it works. But now, I am trying to 
> avoid using NAT.
> 
> The problem with NAT (as I understand it) is it rewrites the destination 
> address, which breaks HTTP/1.0 requests without a Host: header. By using 
> policy routing, I hope to route traffic through wum without rewriting 
> the destination address.
> 
> I'm using as my guide the Transparent Proxy HOWTO by Daniel Kiracofe.

As Jason wrote, REDIRECT will also rewrite destination IP address. 
Squid is using woodoo magic to find out what was the original 
destination address before rewriting (that's why you need to also change 
Squid configuration).  Squid can do that only if it runs on the same box 
where the address was rewritten.  Even the woodoo magic has limitations ;-)

Daniel's document is using nat table for both filtering and NATing, 
which is the approach I don't particulary like.  Plus the rules are very 
open (made to demonstrate the concept, not to be used on a real firewall).

Anyhow, what you might try out is a bit of debugging to see what is 
going on the wire.  Your tcpdump from wum shows that it got SYN packet, 
and that it sent out SYN ACK.  I don't see third packet with ACK going 
back to wum, so it might be that it got dropped somewhere.  My next step 
would be to move to tor.  I'd guess if you run tcpdump on tor's 
interface to internal network, you'd see only SYN packet, and not SYN 
ACK.  And if you run it on interface wheer wum is connected that you 
would see both SYN and SYN ACK.  If that is the case, than you might 
have something else on tor that is causing it to drop return packets 
from wum.  As usual, without having an insight into your entire rule 
set, it might be hard to tell why (something like output of iptables-save).

-- 
Aleksandar Milivojevic <amilivojevic@pbl.ca>    Pollard Banknote Limited
Systems Administrator                           1499 Buffalo Place
Tel: (204) 474-2323 ext 276                     Winnipeg, MB  R3T 1L7