[LARTC] ip rule and transparent proxy.

[LARTC] ip rule and transparent proxy.

[Alessandro Ren]

	Hello,

	I have a linux box with 2 internet links where I am dividing the
traffic among both links. I have one link for VPN and the other one for
internet access in general.
	The main routing table has its default gateway and it's used for VPN
access and the other routing table is used to deviate all the other traffic.
If a set transparent proxy, all tha traffic goes out through the main
routing table, but I'd like it do go out in the second default gateway.
	I've tried to mark packets but it did't work for transparent proxy.
Any sugestions here?
	I have in the second routing table routes for the VPNs LAN pointing
to the defalut route of the main routing table and rest gets out in the
second link.

	Thanks a lot.

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] ip rule and transparent proxy.

[Esteban Ribicic]

you should try marking squid packets (output chain for example) and then
add a rule (ip rule ls)..
in lartc.org http://www.lartc.org/lartc.pdf have plenty of examples.

tips: when marking packets on iptables, use hexa not decimal notting.
try patching the kernel if does not work (http://www.ssi.bg/~ja/) cause
kernel default source may not work...

and its probably that squid use as source adrres of ip header the ip on
the default route, so you might have to nat that src to the other
interface (so packets leave the interface you want and come back in that
interface and not the other -if they come..- )

greets and good speed.

On Wed, 2003-03-05 at 10:27, Alessandro Ren wrote:
> 
> 	Hello,
> 
> 	I have a linux box with 2 internet links where I am dividing the
> traffic among both links. I have one link for VPN and the other one for
> internet access in general.
> 	The main routing table has its default gateway and it's used for VPN
> access and the other routing table is used to deviate all the other traffic.
> If a set transparent proxy, all tha traffic goes out through the main
> routing table, but I'd like it do go out in the second default gateway.
> 	I've tried to mark packets but it did't work for transparent proxy.
> Any sugestions here?
> 	I have in the second routing table routes for the VPNs LAN pointing
> to the defalut route of the main routing table and rest gets out in the
> second link.
> 
> 	Thanks a lot.


_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] ip rule and transparent proxy.

[Stephane Ouellette]

Esteban Ribicic wrote:

>you should try marking squid packets (output chain for example) and then
>add a rule (ip rule ls)..
>in lartc.org http://www.lartc.org/lartc.pdf have plenty of examples.
>  
>

   Unfortunately, this will not work.  It is not possible to route a 
locally-generated packet using a firewall mark because the routing 
decision is taken before the packet is sent to the MANGLE OUTPUT chain. 
  Routing a packet using a firewall mark works only in the PREROUTING 
Netfilter hook.

Stephane Ouellette

>tips: when marking packets on iptables, use hexa not decimal notting.
>try patching the kernel if does not work (http://www.ssi.bg/~ja/) cause
>kernel default source may not work...
>
>and its probably that squid use as source adrres of ip header the ip on
>the default route, so you might have to nat that src to the other
>interface (so packets leave the interface you want and come back in that
>interface and not the other -if they come..- )
>
>greets and good speed.
>
>On Wed, 2003-03-05 at 10:27, Alessandro Ren wrote:
>  
>


_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] ip rule and transparent proxy.

[Esteban Ribicic]

after marking the packet, it is posible to route over ip (marking in
output)...packet goes to the gw you choose..routeing after is other
issue, as you cant know or predict what will do your isp router.

the packet will go where you told him to go (through fwmarks) with src
address as kernel algorithm says so (probably, if not bind() called, the
ip address of the interface on wich the default gw is setted)..

if the src address of the packet does not match with the interface you
choose, is probably that the packet leaves the interface and never come
back -my scpecial case, is that my two links are from the same isp and
they route the packet trgout a default route in their router- ..so
packets leaves from one interface and comes in the other... but, you can
(i hvent tryed this, but i think it should work) nat the src adress and
packet will go and come....maybe you shlud nat the packet again when it
comes...
example: ip rule add from all fwmark 0x1 nat [your ip] table pppx..for
example..

i have working hwat i said on my linux box for squid packets..the go
from one interface and come in the other.

steve

On Wed, 2003-03-05 at 12:40, Stephane Ouellette wrote:
> Esteban Ribicic wrote:
> 
> >you should try marking squid packets (output chain for example) and then
> >add a rule (ip rule ls)..
> >in lartc.org http://www.lartc.org/lartc.pdf have plenty of examples.
> >  
> >
> 
>    Unfortunately, this will not work.  It is not possible to route a 
> locally-generated packet using a firewall mark because the routing 
> decision is taken before the packet is sent to the MANGLE OUTPUT chain. 
>   Routing a packet using a firewall mark works only in the PREROUTING 
> Netfilter hook.
> 
> Stephane Ouellette
> 
> >tips: when marking packets on iptables, use hexa not decimal notting.
> >try patching the kernel if does not work (http://www.ssi.bg/~ja/) cause
> >kernel default source may not work...
> >
> >and its probably that squid use as source adrres of ip header the ip on
> >the default route, so you might have to nat that src to the other
> >interface (so packets leave the interface you want and come back in that
> >interface and not the other -if they come..- )
> >
> >greets and good speed.
> >
> >On Wed, 2003-03-05 at 10:27, Alessandro Ren wrote:
> >  
> >
> 

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

RE: [LARTC] ip rule and transparent proxy.

[Alessandro Ren]

	It did't work becasue the packet is trying to go out on the
secondary interface using the address of the primary interface, so the
packet get dropped by the ISP.
	Well, the MARK on the OUTPUT mangle worked well actually, deviating
the traffic, just creating the source address problem.

	Am I forgetting something?
	
	Thanks.

-----Original Message-----
From: lartc-admin@mailman.ds9a.nl [mailto:lartc-admin@mailman.ds9a.nl] On
Behalf Of Esteban Ribicic
Sent: Wednesday, March 05, 2003 1:00 PM
To: Stephane Ouellette
Cc: Esteban Ribicic; Alessandro Ren; LARTC
Subject: Re: [LARTC] ip rule and transparent proxy.


after marking the packet, it is posible to route over ip (marking in
output)...packet goes to the gw you choose..routeing after is other issue,
as you cant know or predict what will do your isp router.

the packet will go where you told him to go (through fwmarks) with src
address as kernel algorithm says so (probably, if not bind() called, the ip
address of the interface on wich the default gw is setted)..

if the src address of the packet does not match with the interface you
choose, is probably that the packet leaves the interface and never come back
-my scpecial case, is that my two links are from the same isp and they route
the packet trgout a default route in their router- ..so packets leaves from
one interface and comes in the other... but, you can (i hvent tryed this,
but i think it should work) nat the src adress and packet will go and
come....maybe you shlud nat the packet again when it comes...
example: ip rule add from all fwmark 0x1 nat [your ip] table pppx..for
example..

i have working hwat i said on my linux box for squid packets..the go from
one interface and come in the other.

steve

On Wed, 2003-03-05 at 12:40, Stephane Ouellette wrote:
> Esteban Ribicic wrote:
> 
> >you should try marking squid packets (output chain for example) and 
> >then add a rule (ip rule ls).. in lartc.org 
> >http://www.lartc.org/lartc.pdf have plenty of examples.
> >  
> >
> 
>    Unfortunately, this will not work.  It is not possible to route a
> locally-generated packet using a firewall mark because the routing 
> decision is taken before the packet is sent to the MANGLE OUTPUT chain. 
>   Routing a packet using a firewall mark works only in the PREROUTING 
> Netfilter hook.
> 
> Stephane Ouellette
> 
> >tips: when marking packets on iptables, use hexa not decimal notting. 
> >try patching the kernel if does not work (http://www.ssi.bg/~ja/) 
> >cause kernel default source may not work...
> >
> >and its probably that squid use as source adrres of ip header the ip 
> >on the default route, so you might have to nat that src to the other 
> >interface (so packets leave the interface you want and come back in 
> >that interface and not the other -if they come..- )
> >
> >greets and good speed.
> >
> >On Wed, 2003-03-05 at 10:27, Alessandro Ren wrote:
> >  
> >
> 

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

RE: [LARTC] ip rule and transparent proxy.

[Esteban Ribicic]

yeah, try natting the packet on the rule so src addreess will chanche.
that might work.

or try looking on squids patches or docu if you can specify anything on
it.

greets

On Thu, 2003-03-06 at 11:18, Alessandro Ren wrote:
> 
> 	It did't work becasue the packet is trying to go out on the
> secondary interface using the address of the primary interface, so the
> packet get dropped by the ISP.
> 	Well, the MARK on the OUTPUT mangle worked well actually, deviating
> the traffic, just creating the source address problem.
> 
> 	Am I forgetting something?
> 	
> 	Thanks.
> 
> -----Original Message-----
> From: lartc-admin@mailman.ds9a.nl [mailto:lartc-admin@mailman.ds9a.nl] On
> Behalf Of Esteban Ribicic
> Sent: Wednesday, March 05, 2003 1:00 PM
> To: Stephane Ouellette
> Cc: Esteban Ribicic; Alessandro Ren; LARTC
> Subject: Re: [LARTC] ip rule and transparent proxy.
> 
> 
> after marking the packet, it is posible to route over ip (marking in
> output)...packet goes to the gw you choose..routeing after is other issue,
> as you cant know or predict what will do your isp router.
> 
> the packet will go where you told him to go (through fwmarks) with src
> address as kernel algorithm says so (probably, if not bind() called, the ip
> address of the interface on wich the default gw is setted)..
> 
> if the src address of the packet does not match with the interface you
> choose, is probably that the packet leaves the interface and never come back
> -my scpecial case, is that my two links are from the same isp and they route
> the packet trgout a default route in their router- ..so packets leaves from
> one interface and comes in the other... but, you can (i hvent tryed this,
> but i think it should work) nat the src adress and packet will go and
> come....maybe you shlud nat the packet again when it comes...
> example: ip rule add from all fwmark 0x1 nat [your ip] table pppx..for
> example..
> 
> i have working hwat i said on my linux box for squid packets..the go from
> one interface and come in the other.
> 
> steve
> 
> On Wed, 2003-03-05 at 12:40, Stephane Ouellette wrote:
> > Esteban Ribicic wrote:
> > 
> > >you should try marking squid packets (output chain for example) and 
> > >then add a rule (ip rule ls).. in lartc.org 
> > >http://www.lartc.org/lartc.pdf have plenty of examples.
> > >  
> > >
> > 
> >    Unfortunately, this will not work.  It is not possible to route a
> > locally-generated packet using a firewall mark because the routing 
> > decision is taken before the packet is sent to the MANGLE OUTPUT chain. 
> >   Routing a packet using a firewall mark works only in the PREROUTING 
> > Netfilter hook.
> > 
> > Stephane Ouellette
> > 
> > >tips: when marking packets on iptables, use hexa not decimal notting. 
> > >try patching the kernel if does not work (http://www.ssi.bg/~ja/) 
> > >cause kernel default source may not work...
> > >
> > >and its probably that squid use as source adrres of ip header the ip 
> > >on the default route, so you might have to nat that src to the other 
> > >interface (so packets leave the interface you want and come back in 
> > >that interface and not the other -if they come..- )
> > >
> > >greets and good speed.
> > >
> > >On Wed, 2003-03-05 at 10:27, Alessandro Ren wrote:
> > >  
> > >
> > 
> 
> _______________________________________________
> LARTC mailing list / LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
> 
> 
-- 
Esteban Ribicic
Network Operation Center
UOL-Sinectis S.A.

Florida 537 Piso 6, Buenos Aires, Argentina 
+54-11-4321-9110 Ext 2503
+54-11-4321-9107 Directo 
eribicic@uolsinectis.com
www.uolsinectis.com

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

RE: [LARTC] ip rule and transparent proxy.

[Alessandro Ren]

	I found a way to do that.
	You have to mark tha packet on the OUTPUT, make a rule for that mark
to go to where you want and you must set the tcp_outgoing_address in the
squid.conf file to match the IP address of the interface you want the squid
to start the connections from.
	It's working flawlessly for me.
	The only think is, if link on this interface goes down, squid will
not be able do access the internet anymore. I just wrote a script that
checks this interface and if its down, changes the squid configuration file
disabling the tcp_outgoing_address.
	[]s.


-----Original Message-----
From: lartc-admin@mailman.ds9a.nl [mailto:lartc-admin@mailman.ds9a.nl] On
Behalf Of Esteban Ribicic
Sent: Thursday, March 06, 2003 12:11 PM
To: Alessandro Ren
Cc: 'LARTC'
Subject: RE: [LARTC] ip rule and transparent proxy.


yeah, try natting the packet on the rule so src addreess will chanche. that
might work.

or try looking on squids patches or docu if you can specify anything on it.

greets

On Thu, 2003-03-06 at 11:18, Alessandro Ren wrote:
> 
> 	It did't work becasue the packet is trying to go out on the
secondary 
> interface using the address of the primary interface, so the packet 
> get dropped by the ISP.
> 	Well, the MARK on the OUTPUT mangle worked well actually, deviating 
> the traffic, just creating the source address problem.
> 
> 	Am I forgetting something?
> 	
> 	Thanks.
> 
> -----Original Message-----
> From: lartc-admin@mailman.ds9a.nl [mailto:lartc-admin@mailman.ds9a.nl] 
> On Behalf Of Esteban Ribicic
> Sent: Wednesday, March 05, 2003 1:00 PM
> To: Stephane Ouellette
> Cc: Esteban Ribicic; Alessandro Ren; LARTC
> Subject: Re: [LARTC] ip rule and transparent proxy.
> 
> 
> after marking the packet, it is posible to route over ip (marking in 
> output)...packet goes to the gw you choose..routeing after is other 
> issue, as you cant know or predict what will do your isp router.
> 
> the packet will go where you told him to go (through fwmarks) with src 
> address as kernel algorithm says so (probably, if not bind() called, 
> the ip address of the interface on wich the default gw is setted)..
> 
> if the src address of the packet does not match with the interface you 
> choose, is probably that the packet leaves the interface and never 
> come back -my scpecial case, is that my two links are from the same 
> isp and they route the packet trgout a default route in their router- 
> ..so packets leaves from one interface and comes in the other... but, 
> you can (i hvent tryed this, but i think it should work) nat the src 
> adress and packet will go and come....maybe you shlud nat the packet 
> again when it comes...
> example: ip rule add from all fwmark 0x1 nat [your ip] table pppx..for
> example..
> 
> i have working hwat i said on my linux box for squid packets..the go 
> from one interface and come in the other.
> 
> steve
> 
> On Wed, 2003-03-05 at 12:40, Stephane Ouellette wrote:
> > Esteban Ribicic wrote:
> > 
> > >you should try marking squid packets (output chain for example) and
> > >then add a rule (ip rule ls).. in lartc.org 
> > >http://www.lartc.org/lartc.pdf have plenty of examples.
> > >  
> > >
> > 
> >    Unfortunately, this will not work.  It is not possible to route a 
> > locally-generated packet using a firewall mark because the routing 
> > decision is taken before the packet is sent to the MANGLE OUTPUT chain.
> >   Routing a packet using a firewall mark works only in the 
> > PREROUTING
> > Netfilter hook.
> > 
> > Stephane Ouellette
> > 
> > >tips: when marking packets on iptables, use hexa not decimal 
> > >notting.
> > >try patching the kernel if does not work (http://www.ssi.bg/~ja/) 
> > >cause kernel default source may not work...
> > >
> > >and its probably that squid use as source adrres of ip header the 
> > >ip
> > >on the default route, so you might have to nat that src to the other 
> > >interface (so packets leave the interface you want and come back in 
> > >that interface and not the other -if they come..- )
> > >
> > >greets and good speed.
> > >
> > >On Wed, 2003-03-05 at 10:27, Alessandro Ren wrote:
> > >  
> > >
> > 
> 
> _______________________________________________
> LARTC mailing list / LARTC@mailman.ds9a.nl 
> http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
> 
> 
-- 
Esteban Ribicic
Network Operation Center
UOL-Sinectis S.A.

Florida 537 Piso 6, Buenos Aires, Argentina 
+54-11-4321-9110 Ext 2503
+54-11-4321-9107 Directo
eribicic@uolsinectis.com
www.uolsinectis.com

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/