From: Amos Jeffries <squid3@treenet.co.nz>
To: Robert Pipca <robertpipca@gmail.com>
Cc: netfilter@vger.kernel.org
Subject: Re: Re-route non-http traffic
Date: Mon, 01 Nov 2010 18:39:07 +1300 [thread overview]
Message-ID: <4CCE527B.7000101@treenet.co.nz> (raw)
In-Reply-To: <AANLkTi=GvwtxOLtFH9444aqdudrkUbaPdYQ63ZrUTH2A@mail.gmail.com>
On 01/11/10 15:51, Robert Pipca wrote:
> Hi,
>
> I'm using squid as a webcache in bridge-mode.
>
> I use ebtables on tcp/80 to get the http traffic.
>
> The thing is: this is an ISP, so some clients are companies that use
> tcp/80 to non-http traffic (proprietary protocols mostly, eg.
> biometric identification machines on a medical institution, for
> instance).
>
> So my question is: Since I can know what's the dst IP when the
> connection arrives on netfilter, can I do something like:
>
> "redirect this to the squid port, but save the destination IP".
>
> If squid sees this is not http-traffic, sends the connection to _that_
> saved destination IP...and everybody is happy.
>
> Is it possible currently? Or is some coding necessary? We can help with that..
>
That is not possible at all. No "currently" about it.
You have to detect and bypass the connections before attempting to
redirect to Squid. Once the first identifiable byte of non-HTTP hits
Squid the TCP setup packets are already long gone. Depending on the data
up to 64KB may also have already flowed through the connection.
AYJ
next prev parent reply other threads:[~2010-11-01 5:39 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-11-01 2:51 Re-route non-http traffic Robert Pipca
2010-11-01 5:39 ` Amos Jeffries [this message]
2010-11-01 15:03 ` Grant Taylor
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4CCE527B.7000101@treenet.co.nz \
--to=squid3@treenet.co.nz \
--cc=netfilter@vger.kernel.org \
--cc=robertpipca@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.