From mboxrd@z Thu Jan 1 00:00:00 1970 From: Cyril COUPEL Subject: Transparent Proxy Date: 25 Nov 2002 14:04:22 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <1038229462.2864.11.camel@sc1.coupel> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="=-IbFNvtuP4ujFDc8U7lXw" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org --=-IbFNvtuP4ujFDc8U7lXw Content-Type: text/plain Content-Transfer-Encoding: 7bit Hi all, First here is my network architecture: 3 Linux Box, B act has router (A and C can even be a group of PCs): ------ ------ ------ | A |----| B |----| C | ------ ------ ------ I need to REDIRECT (DNAT) the traffic from A to B, to a kind of PROXY, and then forward it to C. For it, I need to retreave on B the real server address requested by A to open a new connection from B to C. My Question is: How to retreave the conntrack informations for a connection, without parsing the /proc/net/ipv4/ip_conntrack? Thank in advance. -- Cyril COUPEL --=-IbFNvtuP4ujFDc8U7lXw Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 7bit Hi all,
First here is my network architecture:
3 Linux Box, B act has router (A and C can even be a group of PCs):

------     ------     ------
|  A  |----|  B  |----|  C  |
------     ------     ------

I need to REDIRECT (DNAT) the traffic from A to B, to a kind of PROXY, and then forward it to C.

For it, I need to retreave on B the real server address requested by A to open a new connection from B to C.

My Question is:
How to retreave  the conntrack informations for a connection, without parsing the /proc/net/ipv4/ip_conntrack?

Thank in advance.
--
Cyril COUPEL <cyril@coupel.homelinux.org>
--=-IbFNvtuP4ujFDc8U7lXw-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Kilson Arruda" Subject: Transparent Proxy Date: Wed, 10 Sep 2003 18:19:31 -0300 Sender: netfilter-admin@lists.netfilter.org Message-ID: <20030910221931.2F3C159ACC@pandora.onwave.com.br> Reply-To: "Kilson Arruda" Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii"; To: netfilter@lists.netfilter.org I have a Transparent Proxy like this $IPTABLES -t nat -A PREROUTING -p tcp --dport 80 ! -d $DIRECT_IP -m mac --mac-source $MAC -j REDIRECT --to-port 3128 Question: can I use more then one "! -d", or multiple IPs to don't REDIRE= CT the port 80 for more then one IP? If yes, how can I do this? -- Kilson Arruda Linux User # 228238 ________________________________________________ www.onwave.com.br - Internet e Conectividade From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Tomasz Macioszek" Subject: transparent proxy Date: Fri, 27 Feb 2004 09:48:39 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <003901c3fd0e$88a3c6f0$2a245cc2@cea05> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Netfilter Hello! I have a Linux server acting as a gateway between internal network and internet. The iptables rule set have been working good for long time. I have configured squid on this server. When I have set internal network client to use directly proxy server it has worked properly. But when I have set iptable to redirect all http traffic to squid port (3128) it didn't work (transparent proxy). This is my iptable rule: iptables -t nat -A PREROUTING -p TCP --dport 80 -j REDIRECT --to-port 3128 I think that all options in my kernel are set properly. I don't know why it doesn't work I set tcpdump to listen on 3128 port and when client tried to connect to web server on port 3128 showed only first IP package of this connection and connections failed. Could you send me a solution for this problem? Best regards Tomek From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jeroen Vriesman Subject: Re: transparent proxy Date: Fri, 27 Feb 2004 10:18:29 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <20040227101829.544cceae.j.vriesman@prompt.nl> References: <003901c3fd0e$88a3c6f0$2a245cc2@cea05> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <003901c3fd0e$88a3c6f0$2a245cc2@cea05> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org Hi, you cannot send http traffic directly to a proxy port, these are two different protocols (you also configure your client to use proxy or direct connection). So, you either configure a proxy, use nat for traffic to port 80 (without using the proxy), or configure squid to listen to another port in "http accelerator mode", the last option is what you seem to want. Good luck, Jeroen. On Fri, 27 Feb 2004 09:48:39 +0100 "Tomasz Macioszek" wrote: > Hello! > I have a Linux server acting as a gateway between internal network and > internet. The iptables rule set have been working good for long time. > I have configured squid on this server. When I have set internal network > client to use directly proxy server it has worked properly. But when I have > set iptable to redirect all http traffic to squid port (3128) it didn't > work (transparent proxy). > This is my iptable rule: > iptables -t nat -A PREROUTING -p TCP --dport 80 -j REDIRECT --to-port 3128 > I think that all options in my kernel are set properly. > I don't know why it doesn't work > I set tcpdump to listen on 3128 port and when client tried to connect to web > server on port 3128 showed only first IP package of this connection and > connections failed. > Could you send me a solution for this problem? > Best regards > Tomek > > From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: transparent proxy Date: Fri, 27 Feb 2004 09:27:19 +0000 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200402270927.19754.Antony@Soft-Solutions.co.uk> References: <003901c3fd0e$88a3c6f0$2a245cc2@cea05> <20040227101829.544cceae.j.vriesman@prompt.nl> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <20040227101829.544cceae.j.vriesman@prompt.nl> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org On Friday 27 February 2004 9:18 am, Jeroen Vriesman wrote: > Hi, > > you cannot send http traffic directly to a proxy port, Yes you can. See the example netfilter rule given on the Squid FQ at http://www.squid-cache.org/Doc/FAQ/FAQ-17.html#ss17.4 and http://en.tldp.org/HOWTO/TransparentProxy-5.html Antony. -- Ramdisk is not an installation procedure. Please reply to the list; please don't CC me. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jeroen Vriesman Subject: Re: transparent proxy Date: Fri, 27 Feb 2004 11:25:11 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <20040227112511.57fcc4a6.j.vriesman@prompt.nl> References: <003901c3fd0e$88a3c6f0$2a245cc2@cea05> <20040227101829.544cceae.j.vriesman@prompt.nl> <200402270927.19754.Antony@Soft-Solutions.co.uk> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <200402270927.19754.Antony@Soft-Solutions.co.uk> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org Ojee, that means I'm living in the past, sorry. On Fri, 27 Feb 2004 09:27:19 +0000 Antony Stone wrote: > On Friday 27 February 2004 9:18 am, Jeroen Vriesman wrote: > > > Hi, > > > > you cannot send http traffic directly to a proxy port, > > Yes you can. > > See the example netfilter rule given on the Squid FQ at > http://www.squid-cache.org/Doc/FAQ/FAQ-17.html#ss17.4 > and http://en.tldp.org/HOWTO/TransparentProxy-5.html > > Antony. > > -- > Ramdisk is not an installation procedure. > > Please reply to the list; > please don't CC me. > > From mboxrd@z Thu Jan 1 00:00:00 1970 From: "John A. Sullivan III" Subject: Re: transparent proxy Date: Fri, 27 Feb 2004 06:50:30 -0500 Sender: netfilter-admin@lists.netfilter.org Message-ID: <1077882630.2140.59.camel@localhost> References: <003901c3fd0e$88a3c6f0$2a245cc2@cea05> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <003901c3fd0e$88a3c6f0$2a245cc2@cea05> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Tomasz Macioszek Cc: Netfilter On Fri, 2004-02-27 at 03:48, Tomasz Macioszek wrote: > Hello! > I have a Linux server acting as a gateway between internal network and > internet. The iptables rule set have been working good for long time. > I have configured squid on this server. When I have set internal network > client to use directly proxy server it has worked properly. But when I have > set iptable to redirect all http traffic to squid port (3128) it didn't > work (transparent proxy). > This is my iptable rule: > iptables -t nat -A PREROUTING -p TCP --dport 80 -j REDIRECT --to-port 3128 > I think that all options in my kernel are set properly. > I don't know why it doesn't work > I set tcpdump to listen on 3128 port and when client tried to connect to web > server on port 3128 showed only first IP package of this connection and > connections failed. > Could you send me a solution for this problem? > Best regards > Tomek It has been a while since I set up Squid but I would suggest looking in a few areas. Do you really want to redirect all traffic on port 80 or just the traffic coming in from the internal interface? Have you allowed traffic to pass on the loopback interface? I do not recall if one needs to allow traffic to port 3128 on the INPUT chain. -- John A. Sullivan III Chief Technology Officer Nexus Management +1 207-985-7880 john.sullivan@nexusmgmt.com --- If you are interested in helping to develop a GPL enterprise class VPN/Firewall/Security device management console, please visit http://iscs.sourceforge.net From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Daniel F. Chief Security Engineer -" Subject: Re: transparent proxy Date: Fri, 27 Feb 2004 11:00:56 -0600 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200402271100.56511.danielf@supportteam.net> References: <003901c3fd0e$88a3c6f0$2a245cc2@cea05> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <003901c3fd0e$88a3c6f0$2a245cc2@cea05> Content-Disposition: inline Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Tomasz Macioszek , Netfilter That rule should work fine, make sure you compiled squid with: ./configure --enable-linux-netfilter But for more usefull info :) Here is a nice HOW-TO http://en.tldp.org/HOWTO/TransparentProxy.html On Friday 27 February 2004 02:48, Tomasz Macioszek wrote: > Hello! > I have a Linux server acting as a gateway between internal network and > internet. The iptables rule set have been working good for long time. > I have configured squid on this server. When I have set internal network > client to use directly proxy server it has worked properly. But when I have > set iptable to redirect all http traffic to squid port (3128) it didn't > work (transparent proxy). > This is my iptable rule: > iptables -t nat -A PREROUTING -p TCP --dport 80 -j REDIRECT --to-port 3128 > I think that all options in my kernel are set properly. > I don't know why it doesn't work > I set tcpdump to listen on 3128 port and when client tried to connect to > web server on port 3128 showed only first IP package of this connection > and connections failed. > Could you send me a solution for this problem? > Best regards > Tomek -- _,.-:*"``'*:-.,_,.-:*"``'*:-.,_,.-:*"``'*:-.,_,.-:*"``'*:-.,_,.-:*"``'*:-.,_ Daniel Fairchild - Chief Security Officer | danielf@supportteam.net The distance between nothing and infinity is always the same no matter how close you get to nothing. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Guillermo Chui Lau Subject: RE: transparent proxy Date: Fri, 27 Feb 2004 14:19:41 -0500 Sender: netfilter-admin@lists.netfilter.org Message-ID: <6B4345976F8D444ABCFEF8B628BAC1A0431565@APPSRV> Mime-Version: 1.0 Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: netfilter@lists.netfilter.org Cc: tomekm@cea.pl On Fri, 27 Feb 2004 09:48:39 +0100 "Tomasz Macioszek" wrote: > Hello! > I have a Linux server acting as a gateway between internal network and > internet. The iptables rule set have been working good for long time. > I have configured squid on this server. When I have set internal network > client to use directly proxy server it has worked properly. But when I have > set iptable to redirect all http traffic to squid port (3128) it didn't > work (transparent proxy). > This is my iptable rule: > iptables -t nat -A PREROUTING -p TCP --dport 80 -j REDIRECT --to-port 3128 > I think that all options in my kernel are set properly. > I don't know why it doesn't work > I set tcpdump to listen on 3128 port and when client tried to connect to web > server on port 3128 showed only first IP package of this connection and > connections failed. > Could you send me a solution for this problem? > Best regards > Tomek > > YOU NEED TO IMPLEMENT THIS RULE iptables -t nat -A PREROUTING -i $LAN_IFACE -p tcp --dport 80 \ -j REDIRECT --to-port 3128 LINUX SERVER HACKS Rob Flickenger also make squid run in levels 3 ,4 and 5 chkconfig --level 345 squid on if this doesnt work see if the iptables is doing nat you should have a rule like this one iptables -t nat -A POSTROUTING -o $INET_IFACE -j SNAT --to-source $INET_IP also check if you are loading the modules /sbin/modprobe ip_tables /sbin/modprobe ip_conntrack /sbin/modprobe iptable_filter /sbin/modprobe iptable_mangle /sbin/modprobe iptable_nat /sbin/modprobe ipt_LOG /sbin/modprobe ipt_limit /sbin/modprobe ipt_state you can check the modules using lsmod Guillermo Chui Lau Support Enginner From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Fredrik Emil Jensen" Subject: RE: transparent proxy Date: Mon, 15 Mar 2004 10:19:35 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <3C204966522884458700FF59D6EFB87A474DDE@FORUS01.netpower.lan> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: Content-class: urn:content-classes:message Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Netfilter Hey=20 I'm currently using squid and squidGuard for redirection. Setting up the rules: Iptables -t nat -A PREROUTING -p tcp -s 192.168.1.0/24 -d 0/0 --dport 80 -j REDIRECT --to-ports 3128=20 But does anyone know what to do if you want to use iptables to bypass squid with single IP address? I know that you can add the rule "iptables -t nat -A POSTROUTING -o eth0 -s 192.168.1.10/32 -d 0/0 -j SNAT --to "source_Wan_address" ". But this rule will be added at the end of the rule list, and all traffic on port 80 will still be redirected through squid. Even when I use priority "iptables -t nat -I POSTROUTING 1 etc" and I put higher priority on the rule for the bypass IP, it is still being redirected through squid. I have to remove the redirect rule before I can bypass squid.=20 Does anyone know what I'm doing wrong? Using Slackware 9.1 with Kernel 2.6.2, iptables version 1.2.9 and squid 2.5 Regards,=20 Fredrik -----Original Message----- From: Daniel F. Chief Security Engineer - [mailto:danielf@supportteam.net]=20 Sent: 27. februar 2004 18:01 To: Tomasz Macioszek; Netfilter Subject: Re: transparent proxy That rule should work fine, make sure you compiled squid with: ./configure --enable-linux-netfilter=20 But for more usefull info :) Here is a nice HOW-TO http://en.tldp.org/HOWTO/TransparentProxy.html On Friday 27 February 2004 02:48, Tomasz Macioszek wrote: > Hello! > I have a Linux server acting as a gateway between internal network and > internet. The iptables rule set have been working good for long time. > I have configured squid on this server. When I have set internal network > client to use directly proxy server it has worked properly. But when I have > set iptable to redirect all http traffic to squid port (3128) it didn't > work (transparent proxy). > This is my iptable rule: > iptables -t nat -A PREROUTING -p TCP --dport 80 -j REDIRECT --to-port 3128 > I think that all options in my kernel are set properly. > I don't know why it doesn't work > I set tcpdump to listen on 3128 port and when client tried to connect to > web server on port 3128 showed only first IP package of this connection > and connections failed. > Could you send me a solution for this problem? > Best regards > Tomek --=20 _,.-:*"``'*:-.,_,.-:*"``'*:-.,_,.-:*"``'*:-.,_,.-:*"``'*:-.,_,.-:*"``'*: -.,_ Daniel Fairchild - Chief Security Officer | danielf@supportteam.net The distance between nothing and infinity is always the same no matter how=20 close you get to nothing. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Alexander Samad Subject: Re: transparent proxy Date: Tue, 16 Mar 2004 12:57:24 +1100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <20040316015724.GF26800@samad.com.au> References: <3C204966522884458700FF59D6EFB87A474DDE@FORUS01.netpower.lan> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="qABWltju4eaUXBmg" Return-path: Content-Disposition: inline In-Reply-To: <3C204966522884458700FF59D6EFB87A474DDE@FORUS01.netpower.lan> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: Netfilter --qABWltju4eaUXBmg Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Mar 15, 2004 at 10:19:35AM +0100, Fredrik Emil Jensen wrote: > Hey=20 >=20 > I'm currently using squid and squidGuard for redirection. Setting up the > rules: >=20 > Iptables -t nat -A PREROUTING -p tcp -s 192.168.1.0/24 -d 0/0 --dport 80 > -j REDIRECT --to-ports 3128=20 >=20 > But does anyone know what to do if you want to use iptables to bypass > squid with single IP address? >=20 > I know that you can add the rule "iptables -t nat -A POSTROUTING -o eth0 > -s 192.168.1.10/32 -d 0/0 -j SNAT --to "source_Wan_address" ". But this > rule will be added at the end of the rule list, and all traffic on port > 80 will still be redirected through squid. Even when I use priority > "iptables -t nat -I POSTROUTING 1 etc" and I put higher priority on the > rule for the bypass IP, it is still being redirected through squid. I > have to remove the redirect rule before I can bypass squid.=20 -A means to append to the end of the chain -I means to insert at the top or -I INPUT 5 - mean to insert above line 5 of a chain. Chains a processed from top to bottom=20 hope that helps >=20 > Does anyone know what I'm doing wrong? >=20 > Using Slackware 9.1 with Kernel 2.6.2, iptables version 1.2.9 and squid > 2.5 >=20 > Regards,=20 > Fredrik >=20 --qABWltju4eaUXBmg Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFAVl8EkZz88chpJ2MRAun0AJ44mLIp+j77ORXl2Gua7Sn7Vz77CwCghUEW fPh0EuEem5h6M7CMXwwd8MU= =04Px -----END PGP SIGNATURE----- --qABWltju4eaUXBmg-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: transparent proxy Date: Tue, 16 Mar 2004 08:44:24 +0000 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200403160844.24937.Antony@Soft-Solutions.co.uk> References: <3C204966522884458700FF59D6EFB87A474DDE@FORUS01.netpower.lan> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <3C204966522884458700FF59D6EFB87A474DDE@FORUS01.netpower.lan> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Netfilter On Monday 15 March 2004 9:19 am, Fredrik Emil Jensen wrote: > Hey > > I'm currently using squid and squidGuard for redirection. Setting up the > rules: > > Iptables -t nat -A PREROUTING -p tcp -s 192.168.1.0/24 -d 0/0 --dport 80 > -j REDIRECT --to-ports 3128 > > But does anyone know what to do if you want to use iptables to bypass > squid with single IP address? Yes, put a rule above that one in the PREROUTING chain which matches the source address you don't want to be REDIRECTed, and jump out of the chain: iptables -I PREROUTING -t nat -p tcp -s 192.168.1.10 --dport 80 -j ACCEPT That will match a single address, 192.168.1.10, TCP port 80, and make sure the following REDIRECT rule is not activted. Note the "-I" to insert the rule at the top of the list, instead of the more common "-A" which appends to the end of the list. Regards, Antony. -- The difference between theory and practice is that in theory there is no difference, whereas in practice there is. Please reply to the list; please don't CC me. From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Fredrik Emil Jensen" Subject: RE: transparent proxy Date: Wed, 17 Mar 2004 13:33:34 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <3C204966522884458700FF59D6EFB87A01CAFE@FORUS01.netpower.lan> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: Content-class: urn:content-classes:message Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Netfilter Thank you Antony, finally it's working for me. I have another question for the list; is it possible to use iptables to redirect any request on port 80 to a specific web address?=20 I know you can use the rule, iptables -t nat -A PREROUTING -p tcp -s 192.168.1.0/24 -d 0/0 --dport 80 -j DNAT --to ip.address.xx.xx:80 But my problem occurs when you have many different subnets and you want subnet1 to be redirected to http://test.domain.com/site1, subnet2 to be redirected to http://test.domain.com/site2 etc. Does anyone have any suggestions on how to do this with iptables, is it possible? Or do I still need to use squid and squidGuard! Regards,=20 Fredrik -----Original Message----- From: Antony Stone [mailto:Antony@Soft-Solutions.co.uk]=20 Sent: 16. mars 2004 09:44 To: Netfilter Subject: Re: transparent proxy On Monday 15 March 2004 9:19 am, Fredrik Emil Jensen wrote: > Hey > > I'm currently using squid and squidGuard for redirection. Setting up the > rules: > > Iptables -t nat -A PREROUTING -p tcp -s 192.168.1.0/24 -d 0/0 --dport 80 > -j REDIRECT --to-ports 3128 > > But does anyone know what to do if you want to use iptables to bypass > squid with single IP address? Yes, put a rule above that one in the PREROUTING chain which matches the source address you don't want to be REDIRECTed, and jump out of the chain: iptables -I PREROUTING -t nat -p tcp -s 192.168.1.10 --dport 80 -j ACCEPT That will match a single address, 192.168.1.10, TCP port 80, and make sure the=20 following REDIRECT rule is not activted. Note the "-I" to insert the rule=20 at the top of the list, instead of the more common "-A" which appends to the=20 end of the list. Regards, Antony. From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Cannings Subject: Re: transparent proxy Date: Wed, 17 Mar 2004 14:21:12 +0000 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200403171421.12463.lists@edeca.net> References: <3C204966522884458700FF59D6EFB87A01CAFE@FORUS01.netpower.lan> Reply-To: david@edeca.net Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <3C204966522884458700FF59D6EFB87A01CAFE@FORUS01.netpower.lan> Content-Disposition: inline Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org On Wednesday 17 March 2004 12:33, Fredrik Emil Jensen wrote: > Thank you Antony, finally it's working for me. I have another question > for the list; is it possible to use iptables to redirect any request on > port 80 to a specific web address? > > I know you can use the rule, iptables -t nat -A PREROUTING -p tcp -s > 192.168.1.0/24 -d 0/0 --dport 80 -j DNAT --to ip.address.xx.xx:80 > > But my problem occurs when you have many different subnets and you want > subnet1 to be redirected to http://test.domain.com/site1, subnet2 to be > redirected to http://test.domain.com/site2 etc. > > Does anyone have any suggestions on how to do this with iptables, is it > possible? Or do I still need to use squid and squidGuard! That's application level, the request is inside the HTTP packet (which is inside the TCP packet, which is inside the IP packet, etc). iptables cannot do this, you would have to use a proxy such as Apache or Squid. David From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Marco Schuth" Subject: transparent proxy Date: Wed, 10 Mar 2010 00:44:14 +0100 Message-ID: <21B7BA85E0A248919216BC6546842EFB@sence> Reply-To: "Marco Schuth" Mime-Version: 1.0 Content-Transfer-Encoding: QUOTED-PRINTABLE Return-path: Sender: netfilter-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="iso-8859-1"; format="flowed reply-type=original" To: netfilter@vger.kernel.org Hello, Iam using iptables on my router, and have a dedicated proxy server with= =20 squid sarg and squidguard running. all the clients send the request for a website to the default gw (route= r=20 10.12.0.1) the router redirects (dnat) the package to the proxy server ip:10.12.0.250 but in the logs i get the ip from the router. so squid guard doesent work and the squid analytic didn=B4t work becaus= e it=20 shows only the ip from the gw (router) with all requestet pages. how can i change this, that i get in the logs the original ip of the cl= ients=20 ? ----------------------- maybe: snat with the original ip, but how? and make a second entry in t= he=20 proxy to send all packets back to the proxy ? no idea. thanks 4 you help!!!=20 From mboxrd@z Thu Jan 1 00:00:00 1970 From: Amos Jeffries Subject: Re: transparent proxy Date: Wed, 10 Mar 2010 13:23:26 +1300 Message-ID: <857a760cf2ade9bdadec40329e2e010b@mail.treenet.co.nz> References: <21B7BA85E0A248919216BC6546842EFB@sence> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <21B7BA85E0A248919216BC6546842EFB@sence> Sender: netfilter-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="us-ascii" To: Marco Schuth Cc: netfilter@vger.kernel.org On Wed, 10 Mar 2010 00:44:14 +0100, "Marco Schuth" wrote: > Hello, > > Iam using iptables on my router, and have a dedicated proxy server with > squid sarg and squidguard running. > > all the clients send the request for a website to the default gw (router > 10.12.0.1) the router redirects (dnat) > the package to the proxy server ip:10.12.0.250 > but in the logs i get the ip from the router. NAT destroys the IP addresses before they leave the machine doing NAT. Please read the Squid FAQ examples of how to configure policy routing ... Router: http://wiki.squid-cache.org/ConfigExamples/Intercept/IptablesPolicyRoute Squid box: http://wiki.squid-cache.org/ConfigExamples/Intercept/LinuxDnat Amos Squid Project From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mart Frauenlob Subject: Re: transparent proxy Date: Sat, 13 Mar 2010 09:21:23 +0100 Message-ID: <4B9B4B03.7000708@chello.at> References: <21B7BA85E0A248919216BC6546842EFB@sence> <857a760cf2ade9bdadec40329e2e010b@mail.treenet.co.nz> Reply-To: netfilter@vger.kernel.org Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <857a760cf2ade9bdadec40329e2e010b@mail.treenet.co.nz> Sender: netfilter-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="us-ascii" To: netfilter@vger.kernel.org On 10.03.2010 01:23, netfilter-owner@vger.kernel.org wrote: > On Wed, 10 Mar 2010 00:44:14 +0100, "Marco Schuth" > wrote: >> Hello, >> >> Iam using iptables on my router, and have a dedicated proxy server with >> squid sarg and squidguard running. >> >> all the clients send the request for a website to the default gw (router > >> 10.12.0.1) the router redirects (dnat) >> the package to the proxy server ip:10.12.0.250 >> but in the logs i get the ip from the router. > > NAT destroys the IP addresses before they leave the machine doing NAT. > Please read the Squid FAQ examples of how to configure policy routing ... > > Router: > http://wiki.squid-cache.org/ConfigExamples/Intercept/IptablesPolicyRoute > > Squid box: > http://wiki.squid-cache.org/ConfigExamples/Intercept/LinuxDnat > > Amos > Squid Project Hello, I'd like to ask, if in the above examples, the ACCEPT rules need to be placed in the mangle table? Is there a specific reason, couldn't it be done in the filter table? As that would be the intended/preferred use for filtering? If so, don't the examples teach people 'bad manners'? Best regards Mart From mboxrd@z Thu Jan 1 00:00:00 1970 From: /dev/rob0 Subject: Re: transparent proxy Date: Sat, 13 Mar 2010 04:05:05 -0600 Message-ID: <20100313100504.GA10986@minipax> References: <21B7BA85E0A248919216BC6546842EFB@sence> <857a760cf2ade9bdadec40329e2e010b@mail.treenet.co.nz> <4B9B4B03.7000708@chello.at> Reply-To: netfilter@vger.kernel.org Mime-Version: 1.0 Return-path: Content-Disposition: inline In-Reply-To: <4B9B4B03.7000708@chello.at> Sender: netfilter-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: netfilter@vger.kernel.org On Sat, Mar 13, 2010 at 09:21:23AM +0100, Mart Frauenlob wrote: > Amos Jeffries: > > Please read the Squid FAQ examples of how to configure policy > > routing ... > > > > Router: > > http://wiki.squid-cache.org/ConfigExamples/Intercept/IptablesPolicyRoute > > > > Squid box: > > http://wiki.squid-cache.org/ConfigExamples/Intercept/LinuxDnat > > I'd like to ask, if in the above examples, the ACCEPT rules need > to be placed in the mangle table? > Is there a specific reason, couldn't it be done in the filter > table? > As that would be the intended/preferred use for filtering? > If so, don't the examples teach people 'bad manners'? I think Mart is misunderstanding the effect of ACCEPT in mangle. It does not override nor bypass the filter table. It merely means, "we are done mangling this packet." The MARK target is one of those sneaky non-terminating targets. A mark is applied, and the packet continues in that particular chain. Further -j MARK rules could be applied. The ACCEPT rule prevents this. -- Offlist mail to this address is discarded unless "/dev/rob0" or "not-spam" is in Subject: header From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mart Frauenlob Subject: Re: transparent proxy Date: Sat, 13 Mar 2010 13:08:45 +0100 Message-ID: <4B9B804D.7070702@chello.at> References: <21B7BA85E0A248919216BC6546842EFB@sence> <857a760cf2ade9bdadec40329e2e010b@mail.treenet.co.nz> <4B9B4B03.7000708@chello.at> <20100313100504.GA10986@minipax> Reply-To: netfilter@vger.kernel.org Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20100313100504.GA10986@minipax> Sender: netfilter-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="us-ascii" To: netfilter@vger.kernel.org On 13.03.2010 11:05, netfilter-owner@vger.kernel.org wrote: > On Sat, Mar 13, 2010 at 09:21:23AM +0100, Mart Frauenlob wrote: >> Amos Jeffries: >>> Please read the Squid FAQ examples of how to configure policy >>> routing ... >>> >>> Router: >>> http://wiki.squid-cache.org/ConfigExamples/Intercept/IptablesPolicyRoute >>> >>> Squid box: >>> http://wiki.squid-cache.org/ConfigExamples/Intercept/LinuxDnat >> >> I'd like to ask, if in the above examples, the ACCEPT rules need >> to be placed in the mangle table? >> Is there a specific reason, couldn't it be done in the filter >> table? >> As that would be the intended/preferred use for filtering? >> If so, don't the examples teach people 'bad manners'? > > I think Mart is misunderstanding the effect of ACCEPT in mangle. It > does not override nor bypass the filter table. It merely means, "we > are done mangling this packet." > ACCEPT in mangle differs from ACCEPT in mangle? Where is that documented? So you have to ACCEPT it twice? In mangle and in filter table? > The MARK target is one of those sneaky non-terminating targets. A > mark is applied, and the packet continues in that particular chain. > Further -j MARK rules could be applied. The ACCEPT rule prevents > this. Don't we use the RETURN target for that? But yes, that implies a problem, if you RETURN from a user-defined chain. Best regards Mart From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mart Frauenlob Subject: Re: transparent proxy Date: Sat, 13 Mar 2010 13:11:34 +0100 Message-ID: <4B9B80F6.5090508@chello.at> References: <21B7BA85E0A248919216BC6546842EFB@sence> <857a760cf2ade9bdadec40329e2e010b@mail.treenet.co.nz> <4B9B4B03.7000708@chello.at> <20100313100504.GA10986@minipax> <4B9B804D.7070702@chello.at> Reply-To: netfilter@vger.kernel.org Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <4B9B804D.7070702@chello.at> Sender: netfilter-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="us-ascii" To: netfilter@vger.kernel.org On 13.03.2010 13:10, netfilter-owner@vger.kernel.org wrote: > ACCEPT in mangle differs from ACCEPT in mangle? should be: ACCEPT in mangle differs from ACCEPT in filter? From mboxrd@z Thu Jan 1 00:00:00 1970 From: /dev/rob0 Subject: Re: transparent proxy Date: Sat, 13 Mar 2010 10:41:08 -0600 Message-ID: <20100313164108.GB10986@minipax> References: <21B7BA85E0A248919216BC6546842EFB@sence> <857a760cf2ade9bdadec40329e2e010b@mail.treenet.co.nz> <4B9B4B03.7000708@chello.at> <20100313100504.GA10986@minipax> <4B9B804D.7070702@chello.at> Reply-To: netfilter@vger.kernel.org Mime-Version: 1.0 Return-path: Content-Disposition: inline In-Reply-To: <4B9B804D.7070702@chello.at> Sender: netfilter-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: netfilter@vger.kernel.org On Sat, Mar 13, 2010 at 01:08:45PM +0100, Mart Frauenlob wrote: > On 13.03.2010 11:05, netfilter-owner@vger.kernel.org wrote: NB, your MUA is changing the attribution to the envelope sender. Please don't blame the list owner for what I said! :) In a list reply, the attribution should be the header From: address, not the SMTP envelope sender address. > > On Sat, Mar 13, 2010 at 09:21:23AM +0100, Mart Frauenlob wrote: > >> Amos Jeffries: > >>> Please read the Squid FAQ examples of how to configure policy > >>> routing ... > >>> > >>> Router: > >>> http://wiki.squid-cache.org/ConfigExamples/Intercept/IptablesPolicyRoute > >>> > >>> Squid box: > >>> http://wiki.squid-cache.org/ConfigExamples/Intercept/LinuxDnat > >> > >> I'd like to ask, if in the above examples, the ACCEPT > >> rules need to be placed in the mangle table? > >> Is there a specific reason, couldn't it be done in the > >> filter table? > >> As that would be the intended/preferred use for filtering? > >> If so, don't the examples teach people 'bad manners'? > > > > I think Mart is misunderstanding the effect of ACCEPT in mangle. > > It does not override nor bypass the filter table. It merely > > means, "we are done mangling this packet." > > ACCEPT in mangle differs from ACCEPT in filter? Strictly speaking, no, ACCEPT is ACCEPT. Look at no more rules, disregard the chain's policy, pass Go, collect $200. > Where is that documented? > So you have to ACCEPT it twice? In mangle and in filter table? And raw, and nat ... the packet hits all relevant chains/tables. Any of these could change a packet's fate. However, IIUC support for the DROP target in nat and mangle has been removed. > > The MARK target is one of those sneaky non-terminating targets. > > A mark is applied, and the packet continues in that particular > > chain. Further -j MARK rules could be applied. The ACCEPT rule > > prevents this. > > Don't we use the RETURN target for that? But yes, that implies a > problem, if you RETURN from a user-defined chain. RETURN in a built-in means "go to the policy." In a user chain it means "go to the next rule in the calling chain". As you point out, there could be issues with that as the example. ACCEPT works. The only minor nitpick I can think of is that the example used -A, whereas -I would have covered more cases of crazy mangle rulesets. But, -I would fall into the "bad manners" category you were asking about originally. :) If someone has crazy mangle rules, let's hope they understand those rules, because if they don't, they'll have other problems beyond getting their squid working. :) -- Offlist mail to this address is discarded unless "/dev/rob0" or "not-spam" is in Subject: header From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mart Frauenlob Subject: Re: transparent proxy Date: Sat, 13 Mar 2010 22:58:58 +0100 Message-ID: <4B9C0AA2.1090100@chello.at> References: <21B7BA85E0A248919216BC6546842EFB@sence> <857a760cf2ade9bdadec40329e2e010b@mail.treenet.co.nz> <4B9B4B03.7000708@chello.at> <20100313100504.GA10986@minipax> <4B9B804D.7070702@chello.at> <20100313164108.GB10986@minipax> Reply-To: netfilter@vger.kernel.org Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20100313164108.GB10986@minipax> Sender: netfilter-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="us-ascii" To: netfilter@vger.kernel.org On 13.03.2010 17:41, rob0@gmx.co.uk wrote: > On Sat, Mar 13, 2010 at 01:08:45PM +0100, Mart Frauenlob wrote: >> On 13.03.2010 11:05, netfilter-owner@vger.kernel.org wrote: > > NB, your MUA is changing the attribution to the envelope sender. > Please don't blame the list owner for what I said! :) In a list > reply, the attribution should be the header From: address, not the > SMTP envelope sender address. > hrm, yes I see that for a while. I use Mozilla Thunderbird on windowz (stuck to it here). And it's the only Mailing list where I encounter this problem. And it does not occur for all mails. I have no idea why. >>> On Sat, Mar 13, 2010 at 09:21:23AM +0100, Mart Frauenlob wrote: >>>> Amos Jeffries: >>>>> Please read the Squid FAQ examples of how to configure policy >>>>> routing ... >>>>> >>>>> Router: >>>>> http://wiki.squid-cache.org/ConfigExamples/Intercept/IptablesPolicyRoute >>>>> >>>>> Squid box: >>>>> http://wiki.squid-cache.org/ConfigExamples/Intercept/LinuxDnat >>>> >>>> I'd like to ask, if in the above examples, the ACCEPT >>>> rules need to be placed in the mangle table? >>>> Is there a specific reason, couldn't it be done in the >>>> filter table? >>>> As that would be the intended/preferred use for filtering? >>>> If so, don't the examples teach people 'bad manners'? >>> >>> I think Mart is misunderstanding the effect of ACCEPT in mangle. >>> It does not override nor bypass the filter table. It merely >>> means, "we are done mangling this packet." >> >> ACCEPT in mangle differs from ACCEPT in filter? > > Strictly speaking, no, ACCEPT is ACCEPT. Look at no more rules, > disregard the chain's policy, pass Go, collect $200. > >> Where is that documented? >> So you have to ACCEPT it twice? In mangle and in filter table? > > And raw, and nat ... the packet hits all relevant chains/tables. Any > of these could change a packet's fate. However, IIUC support for the > DROP target in nat and mangle has been removed. > I see. Well thank you! 'Mart' really had some misunderstanding about the ACCEPT effect. Guess I've always thought about it as the 'opposite' of DROP. The man page isn't very clear there. 'ACCEPT means to let the packet through.' would need at least a 'the table' at the end of the sentence. >>> The MARK target is one of those sneaky non-terminating targets. >>> A mark is applied, and the packet continues in that particular >>> chain. Further -j MARK rules could be applied. The ACCEPT rule >>> prevents this. >> >> Don't we use the RETURN target for that? But yes, that implies a >> problem, if you RETURN from a user-defined chain. > > RETURN in a built-in means "go to the policy." In a user chain it > means "go to the next rule in the calling chain". As you point out, > there could be issues with that as the example. ACCEPT works. The > only minor nitpick I can think of is that the example used -A, > whereas -I would have covered more cases of crazy mangle rulesets. > > But, -I would fall into the "bad manners" category you were asking > about originally. :) If someone has crazy mangle rules, let's hope > they understand those rules, because if they don't, they'll have > other problems beyond getting their squid working. :) Best regards Mart