RE: [LARTC] ip rule and transparent proxy.

["Alessandro Ren" <alessandro@opservices.com.br>]

	I found a way to do that.
	You have to mark tha packet on the OUTPUT, make a rule for that mark
to go to where you want and you must set the tcp_outgoing_address in the
squid.conf file to match the IP address of the interface you want the squid
to start the connections from.
	It's working flawlessly for me.
	The only think is, if link on this interface goes down, squid will
not be able do access the internet anymore. I just wrote a script that
checks this interface and if its down, changes the squid configuration file
disabling the tcp_outgoing_address.
	[]s.


-----Original Message-----
From: lartc-admin@mailman.ds9a.nl [mailto:lartc-admin@mailman.ds9a.nl] On
Behalf Of Esteban Ribicic
Sent: Thursday, March 06, 2003 12:11 PM
To: Alessandro Ren
Cc: 'LARTC'
Subject: RE: [LARTC] ip rule and transparent proxy.


yeah, try natting the packet on the rule so src addreess will chanche. that
might work.

or try looking on squids patches or docu if you can specify anything on it.

greets

On Thu, 2003-03-06 at 11:18, Alessandro Ren wrote:
> 
> 	It did't work becasue the packet is trying to go out on the
secondary 
> interface using the address of the primary interface, so the packet 
> get dropped by the ISP.
> 	Well, the MARK on the OUTPUT mangle worked well actually, deviating 
> the traffic, just creating the source address problem.
> 
> 	Am I forgetting something?
> 	
> 	Thanks.
> 
> -----Original Message-----
> From: lartc-admin@mailman.ds9a.nl [mailto:lartc-admin@mailman.ds9a.nl] 
> On Behalf Of Esteban Ribicic
> Sent: Wednesday, March 05, 2003 1:00 PM
> To: Stephane Ouellette
> Cc: Esteban Ribicic; Alessandro Ren; LARTC
> Subject: Re: [LARTC] ip rule and transparent proxy.
> 
> 
> after marking the packet, it is posible to route over ip (marking in 
> output)...packet goes to the gw you choose..routeing after is other 
> issue, as you cant know or predict what will do your isp router.
> 
> the packet will go where you told him to go (through fwmarks) with src 
> address as kernel algorithm says so (probably, if not bind() called, 
> the ip address of the interface on wich the default gw is setted)..
> 
> if the src address of the packet does not match with the interface you 
> choose, is probably that the packet leaves the interface and never 
> come back -my scpecial case, is that my two links are from the same 
> isp and they route the packet trgout a default route in their router- 
> ..so packets leaves from one interface and comes in the other... but, 
> you can (i hvent tryed this, but i think it should work) nat the src 
> adress and packet will go and come....maybe you shlud nat the packet 
> again when it comes...
> example: ip rule add from all fwmark 0x1 nat [your ip] table pppx..for
> example..
> 
> i have working hwat i said on my linux box for squid packets..the go 
> from one interface and come in the other.
> 
> steve
> 
> On Wed, 2003-03-05 at 12:40, Stephane Ouellette wrote:
> > Esteban Ribicic wrote:
> > 
> > >you should try marking squid packets (output chain for example) and
> > >then add a rule (ip rule ls).. in lartc.org 
> > >http://www.lartc.org/lartc.pdf have plenty of examples.
> > >  
> > >
> > 
> >    Unfortunately, this will not work.  It is not possible to route a 
> > locally-generated packet using a firewall mark because the routing 
> > decision is taken before the packet is sent to the MANGLE OUTPUT chain.
> >   Routing a packet using a firewall mark works only in the 
> > PREROUTING
> > Netfilter hook.
> > 
> > Stephane Ouellette
> > 
> > >tips: when marking packets on iptables, use hexa not decimal 
> > >notting.
> > >try patching the kernel if does not work (http://www.ssi.bg/~ja/) 
> > >cause kernel default source may not work...
> > >
> > >and its probably that squid use as source adrres of ip header the 
> > >ip
> > >on the default route, so you might have to nat that src to the other 
> > >interface (so packets leave the interface you want and come back in 
> > >that interface and not the other -if they come..- )
> > >
> > >greets and good speed.
> > >
> > >On Wed, 2003-03-05 at 10:27, Alessandro Ren wrote:
> > >  
> > >
> > 
> 
> _______________________________________________
> LARTC mailing list / LARTC@mailman.ds9a.nl 
> http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
> 
> 
-- 
Esteban Ribicic
Network Operation Center
UOL-Sinectis S.A.

Florida 537 Piso 6, Buenos Aires, Argentina 
+54-11-4321-9110 Ext 2503
+54-11-4321-9107 Directo
eribicic@uolsinectis.com
www.uolsinectis.com

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/