attempting to transparently proxy with this script to no avail

attempting to transparently proxy with this script to no avail

[joe z]

this script runs everything fine just the redirect doesn't. the proxy works 
fine when browser pointed at it.

/sbin/depmod -a
/sbin/modprobe ipt_LOG
/sbin/modprobe ipt_REDIRECT

iptables -F
iptables -t mangle -F
iptables -t nat -F
iptables -X

echo "1" > /proc/sys/net/ipv4/ip_forward
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -t mangle -P PREROUTING ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -A PREROUTING -m tcp -p tcp --dport 80 -j REDIRECT --to-port 
8080

ifdown eth1
ifdown eth0
ifup eth0
ifup eth1
ifconfig eth1 192.168.11.8 netmask 255.255.255.0
ifconfig eth0 192.168.11.10 netmask 255.255.255.0
ifconfig eth0 promisc
ifconfig eth1 promisc
ifconfig eth1 arp
ifconfig eth0 arp

route add 192.168.11.2 dev eth1
route add default gw 192.168.11.2

_________________________________________________________________
Express yourself instantly with MSN Messenger! Download today - it's FREE! 
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

Re: attempting to transparently proxy with this script to no avail (nfcan: addressed to exclusive sender for this address)

[Jim Laurino]

On 2005.03.01 17:03, joe z - securadd@hotmail.com wrote:
> this script runs everything fine just the redirect doesn't. the proxy works  
> fine when browser pointed at it.
>

...

> iptables -t nat -A PREROUTING -m tcp -p tcp --dport 80 -j REDIRECT --to-port  
> 8080

Try this instead:

iptables -t nat -A PREROUTING -m tcp -p tcp --dport 80 -j DNAT --to-port 8080

-- 
Jim Laurino
nfcan.x.jimlaur@dfgh.net
Please reply to the list.
Only mail from the listserver reaches this address.

Re: attempting to transparently proxy with this script to no avail

[Jason Opperisano]

On Tue, 2005-03-01 at 17:03, joe z wrote:
> this script runs everything fine just the redirect doesn't. the proxy works 
> fine when browser pointed at it.
> 
> /sbin/depmod -a
> /sbin/modprobe ipt_LOG
> /sbin/modprobe ipt_REDIRECT
> 
> iptables -F
> iptables -t mangle -F
> iptables -t nat -F
> iptables -X
> 
> echo "1" > /proc/sys/net/ipv4/ip_forward
> iptables -P INPUT ACCEPT
> iptables -P OUTPUT ACCEPT
> iptables -P FORWARD ACCEPT
> iptables -t mangle -P PREROUTING ACCEPT
> iptables -t nat -P PREROUTING ACCEPT
> iptables -t nat -A PREROUTING -m tcp -p tcp --dport 80 -j REDIRECT --to-port 
> 8080

first--when you look at the output of:

  iptables -t nat -vnxL

do you see the packet count incrementing on that rule--if so, good.

second--the proxy *is* running on port 8080, right?  k--moving on...

third--the proxy *is* configured for transparent operation, right?  for
example, if the proxy in question is squid:

  http://www.faqs.org/docs/Linux-mini/TransparentProxy.html#s4

as an aside--it would be better form to specify only packets arriving on
the inside interface in your REDIRECT rule; i.e, "-i $INSIDE_IF"

> ifdown eth1
> ifdown eth0
> ifup eth0
> ifup eth1
> ifconfig eth1 192.168.11.8 netmask 255.255.255.0
> ifconfig eth0 192.168.11.10 netmask 255.255.255.0

um...  err...  never mind...  wait--i'll bite...this machine *is*
forcibly in the path between all web browsers and the Internet, right?

<--snip-->

-j

--
"Ooh, they used nylon rope this time. It feels smooth against my skin,
 almost sensuous."
	--The Simpsons