Re: Transparent Remote Proxy Server

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



ms419@xxxxxxxxxxxxxx wrote:
Thank you sincerely for your suggestion! You are correct: It is simpler to use DNAT & MASQUERADE. I tried it & it works. But now, I am trying to avoid using NAT.

The problem with NAT (as I understand it) is it rewrites the destination address, which breaks HTTP/1.0 requests without a Host: header. By using policy routing, I hope to route traffic through wum without rewriting the destination address.

I'm using as my guide the Transparent Proxy HOWTO by Daniel Kiracofe.

As Jason wrote, REDIRECT will also rewrite destination IP address. Squid is using woodoo magic to find out what was the original destination address before rewriting (that's why you need to also change Squid configuration). Squid can do that only if it runs on the same box where the address was rewritten. Even the woodoo magic has limitations ;-)


Daniel's document is using nat table for both filtering and NATing, which is the approach I don't particulary like. Plus the rules are very open (made to demonstrate the concept, not to be used on a real firewall).

Anyhow, what you might try out is a bit of debugging to see what is going on the wire. Your tcpdump from wum shows that it got SYN packet, and that it sent out SYN ACK. I don't see third packet with ACK going back to wum, so it might be that it got dropped somewhere. My next step would be to move to tor. I'd guess if you run tcpdump on tor's interface to internal network, you'd see only SYN packet, and not SYN ACK. And if you run it on interface wheer wum is connected that you would see both SYN and SYN ACK. If that is the case, than you might have something else on tor that is causing it to drop return packets from wum. As usual, without having an insight into your entire rule set, it might be hard to tell why (something like output of iptables-save).

--
Aleksandar Milivojevic <amilivojevic@xxxxxx>    Pollard Banknote Limited
Systems Administrator                           1499 Buffalo Place
Tel: (204) 474-2323 ext 276                     Winnipeg, MB  R3T 1L7


[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux