by passing transparent proxy

by passing transparent proxy

[Askar]

hi list

i have a very simple question, we have a transparent proxy "squid" for our 
users, this machine is also the default gateway for the user. which mean all 
the traffic of the client do pass from this machine whether its port 80 or 
not.
All teh port 80 traffic redirected to squid 3128 by ...

$iptables -t nat -A PREROUTING -i eth0 -p tcp -s 0/0 --dport 80 -j REDIRECT 
--to-port 3128

Now I want to a client -s xx.xx.xx.xx access a site -d xx.xx.xx.xx then his 
traffic by pass the squid. actaully if the client xx.xx goes through squid 
while accessing that site then the far end web server gives him permission 
denied.
However on web server I could only allow the static ip of the client
xx.xxbut not the squid server. its a secure web server.


any help in this regards wil be greatly appreciated

regards

askar






-- 
Unix is very simple, but it takes a genius to understand the simplicity.
(Dennis Ritchie)

Re: by passing transparent proxy

[Askar]

On 6 Sep 2005 12:04:43 -0000, bimal pandit <bimal_pandit@rediffmail.com> 
wrote:
> 
> Dear Askar, 
> 
> 
> On Tue, 06 Sep 2005 Askar wrote :
> >hi list
> >
> >i have a very simple question, we have a transparent proxy "squid" for 
> our
> >users, this machine is also the default gateway for the user. which mean 
> all
> >the traffic of the client do pass from this machine whether its port 80 
> or
> >not.
> >All teh port 80 traffic redirected to squid 3128 by ...
> >
> >$iptables -t nat -A PREROUTING -i eth0 -p tcp -s 0/0 --dport 80 -j 
> REDIRECT
> >--to-port 3128
> >
> >Now I want to a client -s xx.xx.xx.xx access a site -d xx.xx.xx.xx then 
> his
> >traffic by pass the squid. actaully if the client xx.xx goes through 
> squid
> >while accessing that site then the far end web server gives him 
> permission
> >denied.
> >However on web server I could only allow the static ip of the client
> >xx.xxbut not the squid server. its a secure web server.
> >
> >
> >any help in this regards wil be greatly appreciated
> >
> >regards
> >
> >askar
> >
> >
> 
> I dont think that accessing https request is an issue, I am quite able 
> enough to get it as 443 is under safe port in my squid.conf.
> 


Sorry my bad, from secure means that web server running on port 80 but only 
> accessible from certain IPs (restricted by htaccess)
> 


remember all connections will go through 3128 and will make high port 
> connections for the transactions.
> 
> hope this will help a bit.
> 
> regards,
> 
> Bimal
>  
> 
> <http://adworks.rediff.com/cgi-bin/AdWorks/sigclick.cgi/www.rediff.com/signature-home.htm/1507191490@Middle5?PARTNER=3> 




-- 
Unix is very simple, but it takes a genius to understand the simplicity.
(Dennis Ritchie)

Re: by passing transparent proxy

[/dev/rob0]

On Tuesday 2005-September-06 06:11, Askar wrote:
> All teh port 80 traffic redirected to squid 3128 by ...
>
> $iptables -t nat -A PREROUTING -i eth0 -p tcp -s 0/0 --dport 80 -j
> REDIRECT --to-port 3128
>
> Now I want to a client -s xx.xx.xx.xx access a site -d xx.xx.xx.xx
> then his traffic by pass the squid. actaully if the client xx.xx goes

Precede the proxy rule with a -j RETURN rule for your -s client.IP and 
-d server.IP. See the RETURN target in "man iptables".
-- 
    mail to this address is discarded unless "/dev/rob0"
    or "not-spam" is in Subject: header

Re: by passing transparent proxy

[Askar]

On 9/6/05, /dev/rob0 <rob0@gmx.co.uk> wrote:
> 
> On Tuesday 2005-September-06 06:11, Askar wrote:
> > All teh port 80 traffic redirected to squid 3128 by ...
> >
> > $iptables -t nat -A PREROUTING -i eth0 -p tcp -s 0/0 --dport 80 -j
> > REDIRECT --to-port 3128
> >
> > Now I want to a client -s xx.xx.xx.xx access a site -d xx.xx.xx.xx
> > then his traffic by pass the squid. actaully if the client xx.xx goes
> 
> Precede the proxy rule with a -j RETURN rule for your -s client.IP and
> -d server.IP. See the RETURN target in "man iptables".
> --
> mail to this address is discarded unless "/dev/rob0"
> or "not-spam" is in Subject: header
> 
> 
bingo :)

thanks mate

-- 
Unix is very simple, but it takes a genius to understand the simplicity.
(Dennis Ritchie)