REDIRECT to localhost

REDIRECT to localhost

[Попов Игорь Николаевич]

Hi All,
I have server, that connects my localnet to inet, clients connects to me via PPPoE (ppp[1-9]). I want to run squid on localhost and I want my clients to connect to it.

Can somebody help me with redirect rules?



Igor Popov <igorpopov@newmail.ru>
icq 241601876
__________
www.newmail.ru -- бесплатная почта, бесплатный хостинг.

Re: REDIRECT to localhost

[Ted Kaczmarek]

On Mon, 2004-08-16 at 12:24 +0400, Попов Игорь Николаевич wrote:
> Hi All,
> I have server, that connects my localnet to inet, clients connects to me via PPPoE (ppp[1-9]). I want to run squid on localhost and I want my clients to connect to it.
> 
> Can somebody help me with redirect rules?
> 
> 
> 
> Igor Popov <igorpopov@newmail.ru>
> icq 241601876
> __________
> www.newmail.ru -- бесплатная почта, бесплатный хостинг.
> 

iptables -t nat -A PREROUTING -i "name of interface" -p tcp -m tcp --
dport 80 -j REDIRECT --to-ports 3129

If your default policy is to DROP all INPUT/FORWARD as is it should be.


iptables -A INPUT -i "name of interface" -p tcp -m tcp --dport 80 -j
ACCEPT


You can also use -s "ip address" instead of -i  "name of interface".

Also, you must put the rules in the proper order in the chain, so -A or
-I depends on you.


Ted

REDIRECT to localhost

[igorpopov]

Hi All,
I have server, that connects my localnet to inet, clients connects to me via PPPoE (ppp[1-9]). I want to run squid in transparent mode on localhost and I want my clients to connect to it.

Can somebody help me with redirect rules?

-----
This message was forwarded to you courtesy of the NoSPAM Crusade.
Visit us on the web at: http://nospam.arix.com

RE: REDIRECT to localhost

[Jason Opperisano]

> iptables -t nat -A PREROUTING -i "name of interface" -p tcp -m tcp --
> dport 80 -j REDIRECT --to-ports 3129
>
> If your default policy is to DROP all INPUT/FORWARD as is it should be.
>
>
> iptables -A INPUT -i "name of interface" -p tcp -m tcp --dport 80 -j
> ACCEPT

in this case--where you have ppp[0-9], you can also use the "+" notation to avoid having 10 rules that do the same thing; i.e., 

  iptables -t nat -A PREROUTING -i ppp+ -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3129

will match any ppp interface.

> You can also use -s "ip address" instead of -i  "name of interface".

or both...

-j

Re: REDIRECT to localhost

[Igor Popov]

> > Hi All,
> > I have server, that connects my localnet to inet, clients connects to me
> > via PPPoE (ppp[1-9]). I want to run squid on localhost and I want my
> > clients to connect to it.
> >
> > Can somebody help me with redirect rules?
> >
> >
> >
> > Igor Popov <igorpopov@newmail.ru>
> > icq 241601876


> iptables -t nat -A PREROUTING -i "name of interface" -p tcp -m tcp --
> dport 80 -j REDIRECT --to-ports 3129
>
> If your default policy is to DROP all INPUT/FORWARD as is it should be.
>
>
> iptables -A INPUT -i "name of interface" -p tcp -m tcp --dport 80 -j
> ACCEPT
>


As I know, REDIRECT target redirects to the same iface, but on another port. I 
can run squid on ppp iface, because it is created dynamically and I don't 
want it to listen on all addresses. I have tried to use REDIRECT and DNAT, 
but without any success.  Now I have created alias for eth0 with ip that lies 
in the same subnet as ppp[1-9] and run squid on it.
May be my problem in antispoofing filter?


-- 
"You have been in Afghanistan, I perceive."
		-- Sir Arthur Conan Doyle, "A Study in Scarlet"

Re: REDIRECT to localhost

[Cedric Blancher]

Le mar 17/08/2004 à 13:02, Igor Popov a écrit :
> As I know, REDIRECT target redirects to the same iface, but on another port.

Nope.
REDIRECT target redirects to lo interface, on the port you want.

> I can run squid on ppp iface, because it is created dynamically and I don't 
> want it to listen on all addresses.

Just have it run on 127.0.0.1, port 3128, and configure it as a
transparent proxy (see Squid doc).

> I have tried to use REDIRECT and DNAT, but without any success.

And finally try this :

	iptables -t nat -A PREROUTING -p tcp --dport 80 \
		-j REDIRECT --to-ports 3128

Should work.


-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!

Re: REDIRECT to localhost

[Ted Kaczmarek]

On Wed, 2004-08-18 at 03:21 +0200, Cedric Blancher wrote:
> Le mar 17/08/2004 à 13:02, Igor Popover a acrid :
> > As I know, REDIRECT target redirects to the same if ace, but on another port.
> 
> Nope.
> REDIRECT target redirects to lo interface, on the port you want.
> 
> > I can run squid on PP if ace, because it is created dynamically and I don't 
> > want it to listen on all addresses.
> 
> Just have it run on 127.0.0.1, port 3128, and configure it as a
> transparent proxy (see Squid doc).
> 
> > I have tried to use REDIRECT and DAT, but without any success.
> 
> And finally try this :
> 
> 	iptables -t nat -A PREROUTING -p tcp --dport 80 \
> 		-j REDIRECT --to-ports 3128

As long as you want ALL port 80 traffic hitting your squid. Otherwise
much better to be specific to interface or even ip block(s). Not a good
idea to be mixing squid for internal use with external accelerator usage
IMHO.
> 
> Should work.
> 
> 
Ted

RE: REDIRECT to localhost

[Jason Opperisano]

> > As I know, REDIRECT target redirects to the same iface, but on another port.
>
> Nope.
> REDIRECT target redirects to lo interface, on the port you want.

hmmm...i'm not so sure i agree with that.  my belief is that REDIRECT redirects to the IP address of the receiving interface of the netfilter machine on the specified port.

i do transparent proxying w/ REDIRECT and squid, and i see all the redirected connections on the IP of the internal interface, not on lo or 127.0.0.1.

i actually just recently learned here that packets arriving on lo that don't have a source and dest of 127.0.0.1 get dropped by the linux kernel's "martian" code (thanks for pointing that out to me)--so i don't see how a redirect of this nature could work.

-j

RE: REDIRECT to localhost

[Cedric Blancher]

Le mer 18/08/2004 à 14:37, Jason Opperisano a écrit :
> hmmm...i'm not so sure i agree with that.  my belief is that REDIRECT
> redirects to the IP address of the receiving interface of the
> netfilter machine on the specified port.

Have to check. You may be right.

> i actually just recently learned here that packets arriving on lo that
> don't have a source and dest of 127.0.0.1 get dropped by the linux
> kernel's "martian" code (thanks for pointing that out to me)--so i
> don't see how a redirect of this nature could work.

Try to ping your local IP. You'll traffic from your local IP to your
local IP (both different from 127.0.0.1) on lo interface.


-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!

RE: REDIRECT to localhost

[Cedric Blancher]

Le mer 18/08/2004 à 15:41, Cedric Blancher a écrit :
> Le mer 18/08/2004 à 14:37, Jason Opperisano a écrit :
> > hmmm...i'm not so sure i agree with that.  my belief is that REDIRECT
> > redirects to the IP address of the receiving interface of the
> > netfilter machine on the specified port.

My mistake. you're right.


-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!