Re: redirect (nfcan: addressed to exclusive sender for this address)

[Georgi Alexandrov <georgi.alexandrov@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 2288 bytes --]

dhottinger@harrisonburg.k12.va.us wrote:
> Quoting Jim Laurino <nfcan.x.jimlaur@dfgh.net>:
> 
>> On 2007.03.08 06:34, dhottinger@harrisonburg.k12.va.us wrote:
>>> Quoting Georgi Alexandrov <georgi.alexandrov@gmail.com>:
>>>
>> .....
>>>>>>> I would like to have any traffic destined for apple.com excluded
>>>>>>> from
>>>>>>> this redirect.  I cant seem to get the syntax right.  Anyone got any
>>>>>>> ideas?
>>>>>> <snip*>
>>>>>>
>>>>>> iptables -t nat -A PREROUTING -p tcp -i $iface --dport 80 -d
>>>>>> $apples_net
>>>>>> -j RETURN
>>>>>>
>> ....
>>>
>>> $IPC -t nat -A PREROUTING -p tcp -i $IF --dport 80 -d 17.250.0.0
>>> -j RETURN
>>>
>>> Is not routing apple.com traffice away from my proxy.  Apple.com
>>> traffic is
>>> still getting routed to proxy server.  I have the rule placed above
>>> my dnat
>>> rule for the proxy.  Any other ideas?
>>
>> The example was non-specific, -d $apples_net.
>> Your implementation, -d 17.250.0.0, is for a specific ip address.
>> You probably meant to specify a range.
>> Iptables allows you to use netmask or cidr syntax.
>> You can cover all of Apple with 17.0.0.0/8 for instance.
>>
>> -- 
>> Jim Laurino
>> nfcan.x.jimlaur@dfgh.net
>> Please reply to the list.
>> Only mail from the listserver reaches this address.
>>
> 
> Yes I know.
>  Sorry I forgot part of my script.  I did
> $IPC -t nat -A PREROUTING -p tcp -i $IF --dport 80 -d 17.250.0.0/16 -j
> RETURN
> 
> Where $IF is the interface that connects to the internet.

No, it should be the interface that your clients are behind.
First try to imagine it in your head then "draw" it with iptables rules ;-)

"I have to redirect all requests coming from my clients to the proxy
server which is here. But I also want requests that are coming from my
clients destined to apple's networks not hit the proxy and go directly
to apple"

in rules it goes like this:
iptables -t nat -A PREROUTING -p tcp -i $clients_interface --dport 80 -d
17.0.0.0/8 -j RETURN
iptables -t nat -A PREROUTING -p tcp -i $clients_interface --dport 80 -j
DNAT --to $proxy_server:$proxy_port

-- 
regards,
Georgi Alexandrov

key server - pgp.mit.edu :: key id - 0x37B4B3EE
Key fingerprint = E429 BF93 FA67 44E9 B7D4  F89E F990 01C1 37B4 B3EE


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]