redirect

redirect

[dhottinger]

I currently redirect all traffic on port 80 to my proxy server with
$IPC -t nat -A PREROUTING -p tcp -i ! $IF --dport 80    -s !  
204.111.40.0/24 -d ! 204.111.40.0/24 -j DNAT --to-destination  
$PROXY_IP:8080

I would like to have any traffic destined for apple.com excluded from  
this redirect.  I cant seem to get the syntax right.  Anyone got any  
ideas?

thanks,

ddh

-- 
Dwayne Hottinger
Network Administrator
Harrisonburg City Public Schools

Re: redirect

[Georgi Alexandrov]

[-- Attachment #1: Type: text/plain, Size: 864 bytes --]

dhottinger@harrisonburg.k12.va.us wrote:
> I currently redirect all traffic on port 80 to my proxy server with
> $IPC -t nat -A PREROUTING -p tcp -i ! $IF --dport 80    -s !
> 204.111.40.0/24 -d ! 204.111.40.0/24 -j DNAT --to-destination
> $PROXY_IP:8080
> 
> I would like to have any traffic destined for apple.com excluded from
> this redirect.  I cant seem to get the syntax right.  Anyone got any ideas?
<snip*>

iptables -t nat -A PREROUTING -p tcp -i $iface --dport 80 -d $apples_net
-j RETURN

iptables -t nat -A PREROUTING -p tcp -i $iface --dport 80 -d
$another_not_to_proxy_network -j RETURN

iptables -t nat -A PREROUTING -p tcp -i $iface --dport 80 -j DNAT --to
$proxy:$port

-- 
regards,
Georgi Alexandrov

key server - pgp.mit.edu :: key id - 0x37B4B3EE
Key fingerprint = E429 BF93 FA67 44E9 B7D4  F89E F990 01C1 37B4 B3EE


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: redirect

[dhottinger]

Quoting Georgi Alexandrov <georgi.alexandrov@gmail.com>:

> dhottinger@harrisonburg.k12.va.us wrote:
>> I currently redirect all traffic on port 80 to my proxy server with
>> $IPC -t nat -A PREROUTING -p tcp -i ! $IF --dport 80    -s !
>> 204.111.40.0/24 -d ! 204.111.40.0/24 -j DNAT --to-destination
>> $PROXY_IP:8080
>>
>> I would like to have any traffic destined for apple.com excluded from
>> this redirect.  I cant seem to get the syntax right.  Anyone got any ideas?
> <snip*>
>
> iptables -t nat -A PREROUTING -p tcp -i $iface --dport 80 -d $apples_net
> -j RETURN
>
> iptables -t nat -A PREROUTING -p tcp -i $iface --dport 80 -d
> $another_not_to_proxy_network -j RETURN
>
> iptables -t nat -A PREROUTING -p tcp -i $iface --dport 80 -j DNAT --to
> $proxy:$port
>
> --
> regards,
> Georgi Alexandrov
>
> key server - pgp.mit.edu :: key id - 0x37B4B3EE
> Key fingerprint = E429 BF93 FA67 44E9 B7D4  F89E F990 01C1 37B4 B3EE
>
>

That seems to work.  I did:
$IPC -t nat -A PREROUTING -p tcp -i $IF --dport 80 -d 17.0.0.0/8 -j RETURN

Dont see the connections in my access.log on my proxy now.


-- 
Dwayne Hottinger
Network Administrator
Harrisonburg City Public Schools

Re: redirect

[dhottinger]

Quoting Georgi Alexandrov <georgi.alexandrov@gmail.com>:

> dhottinger@harrisonburg.k12.va.us wrote:
>> I currently redirect all traffic on port 80 to my proxy server with
>> $IPC -t nat -A PREROUTING -p tcp -i ! $IF --dport 80    -s !
>> 204.111.40.0/24 -d ! 204.111.40.0/24 -j DNAT --to-destination
>> $PROXY_IP:8080
>>
>> I would like to have any traffic destined for apple.com excluded from
>> this redirect.  I cant seem to get the syntax right.  Anyone got any ideas?
> <snip*>
>
> iptables -t nat -A PREROUTING -p tcp -i $iface --dport 80 -d $apples_net
> -j RETURN
>
> iptables -t nat -A PREROUTING -p tcp -i $iface --dport 80 -d
> $another_not_to_proxy_network -j RETURN
>
> iptables -t nat -A PREROUTING -p tcp -i $iface --dport 80 -j DNAT --to
> $proxy:$port
>
> --
> regards,
> Georgi Alexandrov
>
> key server - pgp.mit.edu :: key id - 0x37B4B3EE
> Key fingerprint = E429 BF93 FA67 44E9 B7D4  F89E F990 01C1 37B4 B3EE
>
>

Never mind.  Doesnt seem to be working.  Any other ideas?

ddh


-- 
Dwayne Hottinger
Network Administrator
Harrisonburg City Public Schools

Re: redirect

[Georgi Alexandrov]

[-- Attachment #1: Type: text/plain, Size: 1115 bytes --]

dhottinger@harrisonburg.k12.va.us wrote:
> Quoting Georgi Alexandrov <georgi.alexandrov@gmail.com>:
> 
>> dhottinger@harrisonburg.k12.va.us wrote:
>>> I currently redirect all traffic on port 80 to my proxy server with
>>> $IPC -t nat -A PREROUTING -p tcp -i ! $IF --dport 80    -s !
>>> 204.111.40.0/24 -d ! 204.111.40.0/24 -j DNAT --to-destination
>>> $PROXY_IP:8080
>>>
>>> I would like to have any traffic destined for apple.com excluded from
>>> this redirect.  I cant seem to get the syntax right.  Anyone got any
>>> ideas?
>> <snip*>
>>
>> iptables -t nat -A PREROUTING -p tcp -i $iface --dport 80 -d $apples_net
>> -j RETURN
>>
>> iptables -t nat -A PREROUTING -p tcp -i $iface --dport 80 -d
>> $another_not_to_proxy_network -j RETURN
>>
>> iptables -t nat -A PREROUTING -p tcp -i $iface --dport 80 -j DNAT --to
>> $proxy:$port
<snip*>
> 
> Never mind.  Doesnt seem to be working.  Any other ideas?

What's not working?

-- 
regards,
Georgi Alexandrov

key server - pgp.mit.edu :: key id - 0x37B4B3EE
Key fingerprint = E429 BF93 FA67 44E9 B7D4  F89E F990 01C1 37B4 B3EE


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: redirect

[dhottinger]

Quoting Georgi Alexandrov <georgi.alexandrov@gmail.com>:

> dhottinger@harrisonburg.k12.va.us wrote:
>> Quoting Georgi Alexandrov <georgi.alexandrov@gmail.com>:
>>
>>> dhottinger@harrisonburg.k12.va.us wrote:
>>>> I currently redirect all traffic on port 80 to my proxy server with
>>>> $IPC -t nat -A PREROUTING -p tcp -i ! $IF --dport 80    -s !
>>>> 204.111.40.0/24 -d ! 204.111.40.0/24 -j DNAT --to-destination
>>>> $PROXY_IP:8080
>>>>
>>>> I would like to have any traffic destined for apple.com excluded from
>>>> this redirect.  I cant seem to get the syntax right.  Anyone got any
>>>> ideas?
>>> <snip*>
>>>
>>> iptables -t nat -A PREROUTING -p tcp -i $iface --dport 80 -d $apples_net
>>> -j RETURN
>>>
>>> iptables -t nat -A PREROUTING -p tcp -i $iface --dport 80 -d
>>> $another_not_to_proxy_network -j RETURN
>>>
>>> iptables -t nat -A PREROUTING -p tcp -i $iface --dport 80 -j DNAT --to
>>> $proxy:$port
> <snip*>
>>
>> Never mind.  Doesnt seem to be working.  Any other ideas?
>
> What's not working?
>
> --
> regards,
> Georgi Alexandrov
>
> key server - pgp.mit.edu :: key id - 0x37B4B3EE
> Key fingerprint = E429 BF93 FA67 44E9 B7D4  F89E F990 01C1 37B4 B3EE
>
>

$IPC -t nat -A PREROUTING -p tcp -i $IF --dport 80 -d 17.250.0.0
-j RETURN

Is not routing apple.com traffice away from my proxy.  Apple.com  
traffic is still getting routed to proxy server.  I have the rule  
placed above my dnat rule for the proxy.  Any other ideas?

thanks,
ddh
-- 
Dwayne Hottinger
Network Administrator
Harrisonburg City Public Schools

Re: redirect (nfcan: addressed to exclusive sender for this address)

[Jim Laurino]

On 2007.03.08 06:34, dhottinger@harrisonburg.k12.va.us wrote:
> Quoting Georgi Alexandrov <georgi.alexandrov@gmail.com>:
>
.....
>>>>> I would like to have any traffic destined for apple.com excluded from
>>>>> this redirect.  I cant seem to get the syntax right.  Anyone got any
>>>>> ideas?
>>>> <snip*>
>>>> 
>>>> iptables -t nat -A PREROUTING -p tcp -i $iface --dport 80 -d $apples_net
>>>> -j RETURN
>>>>
....
> 
> $IPC -t nat -A PREROUTING -p tcp -i $IF --dport 80 -d 17.250.0.0
> -j RETURN
> 
> Is not routing apple.com traffice away from my proxy.  Apple.com traffic is  
> still getting routed to proxy server.  I have the rule placed above my dnat  
> rule for the proxy.  Any other ideas?

The example was non-specific, -d $apples_net.
Your implementation, -d 17.250.0.0, is for a specific ip address.
You probably meant to specify a range.
Iptables allows you to use netmask or cidr syntax.
You can cover all of Apple with 17.0.0.0/8 for instance.

-- 
Jim Laurino
nfcan.x.jimlaur@dfgh.net
Please reply to the list.
Only mail from the listserver reaches this address.

Re: redirect (nfcan: addressed to exclusive sender for this address)

[dhottinger]

Quoting Jim Laurino <nfcan.x.jimlaur@dfgh.net>:

> On 2007.03.08 06:34, dhottinger@harrisonburg.k12.va.us wrote:
>> Quoting Georgi Alexandrov <georgi.alexandrov@gmail.com>:
>>
> .....
>>>>>> I would like to have any traffic destined for apple.com excluded from
>>>>>> this redirect.  I cant seem to get the syntax right.  Anyone got any
>>>>>> ideas?
>>>>> <snip*>
>>>>>
>>>>> iptables -t nat -A PREROUTING -p tcp -i $iface --dport 80 -d $apples_net
>>>>> -j RETURN
>>>>>
> ....
>>
>> $IPC -t nat -A PREROUTING -p tcp -i $IF --dport 80 -d 17.250.0.0
>> -j RETURN
>>
>> Is not routing apple.com traffice away from my proxy.  Apple.com traffic is
>> still getting routed to proxy server.  I have the rule placed above my dnat
>> rule for the proxy.  Any other ideas?
>
> The example was non-specific, -d $apples_net.
> Your implementation, -d 17.250.0.0, is for a specific ip address.
> You probably meant to specify a range.
> Iptables allows you to use netmask or cidr syntax.
> You can cover all of Apple with 17.0.0.0/8 for instance.
>
> --
> Jim Laurino
> nfcan.x.jimlaur@dfgh.net
> Please reply to the list.
> Only mail from the listserver reaches this address.
>

Yes I know.
  Sorry I forgot part of my script.  I did
$IPC -t nat -A PREROUTING -p tcp -i $IF --dport 80 -d 17.250.0.0/16 -j RETURN

Where $IF is the interface that connects to the internet.

-- 
Dwayne Hottinger
Network Administrator
Harrisonburg City Public Schools

Re: redirect (nfcan: addressed to exclusive sender for this address)

[Georgi Alexandrov]

[-- Attachment #1: Type: text/plain, Size: 2288 bytes --]

dhottinger@harrisonburg.k12.va.us wrote:
> Quoting Jim Laurino <nfcan.x.jimlaur@dfgh.net>:
> 
>> On 2007.03.08 06:34, dhottinger@harrisonburg.k12.va.us wrote:
>>> Quoting Georgi Alexandrov <georgi.alexandrov@gmail.com>:
>>>
>> .....
>>>>>>> I would like to have any traffic destined for apple.com excluded
>>>>>>> from
>>>>>>> this redirect.  I cant seem to get the syntax right.  Anyone got any
>>>>>>> ideas?
>>>>>> <snip*>
>>>>>>
>>>>>> iptables -t nat -A PREROUTING -p tcp -i $iface --dport 80 -d
>>>>>> $apples_net
>>>>>> -j RETURN
>>>>>>
>> ....
>>>
>>> $IPC -t nat -A PREROUTING -p tcp -i $IF --dport 80 -d 17.250.0.0
>>> -j RETURN
>>>
>>> Is not routing apple.com traffice away from my proxy.  Apple.com
>>> traffic is
>>> still getting routed to proxy server.  I have the rule placed above
>>> my dnat
>>> rule for the proxy.  Any other ideas?
>>
>> The example was non-specific, -d $apples_net.
>> Your implementation, -d 17.250.0.0, is for a specific ip address.
>> You probably meant to specify a range.
>> Iptables allows you to use netmask or cidr syntax.
>> You can cover all of Apple with 17.0.0.0/8 for instance.
>>
>> -- 
>> Jim Laurino
>> nfcan.x.jimlaur@dfgh.net
>> Please reply to the list.
>> Only mail from the listserver reaches this address.
>>
> 
> Yes I know.
>  Sorry I forgot part of my script.  I did
> $IPC -t nat -A PREROUTING -p tcp -i $IF --dport 80 -d 17.250.0.0/16 -j
> RETURN
> 
> Where $IF is the interface that connects to the internet.

No, it should be the interface that your clients are behind.
First try to imagine it in your head then "draw" it with iptables rules ;-)

"I have to redirect all requests coming from my clients to the proxy
server which is here. But I also want requests that are coming from my
clients destined to apple's networks not hit the proxy and go directly
to apple"

in rules it goes like this:
iptables -t nat -A PREROUTING -p tcp -i $clients_interface --dport 80 -d
17.0.0.0/8 -j RETURN
iptables -t nat -A PREROUTING -p tcp -i $clients_interface --dport 80 -j
DNAT --to $proxy_server:$proxy_port

-- 
regards,
Georgi Alexandrov

key server - pgp.mit.edu :: key id - 0x37B4B3EE
Key fingerprint = E429 BF93 FA67 44E9 B7D4  F89E F990 01C1 37B4 B3EE


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]