Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

Re: ipfilter and transparent proxy through squid

13 views
Skip to first unread message

Ross Cameron

unread,
May 9, 2011, 6:27:52 AM5/9/11
to
http://coombs.anu.edu.au/~avalon/examples.html#redirection

From the VERY FIRST RESULT when I Googled for "IPfilter transparent proxy".
    Next time maybe try some reasearch of you're own?




"Opportunity is most often missed by people because it is dressed in overalls and looks like work."
    Thomas Alva Edison
    Inventor of 1093 patents, including:
        The light bulb, phonogram and motion pictures.



On Sun, May 8, 2011 at 12:39 PM, Gabriele Bulfon <gbu...@sonicle.com> wrote:
Hello,
how can I achieve the same as stated in the link below, but using ipfilter?

http://www.cyberciti.biz/tips/linux-setup-transparent-proxy-squid-howto.html

thanx for any help
Gabriele.

Gabriele Bulfon - Sonicle S.r.l.

Tel +39 028246016 Int. 30 - Fax +39 028243880
via Enrico Fermi 44 - 20090, Assago - Milano - Italy
http://www.sonicle.com

Jim Klimov

unread,
May 11, 2011, 6:36:05 AM5/11/11
to
2011-05-11 11:13, Gabriele Bulfon пишет:
hi, there is a "small" issue with rdr to do transparent proxy :

rdr igb0 0.0.0.0/0 port 80 -> 127.0.0.1 port 8080

how can I decide to "transparent proxy" just specific clients?
also, I may want to NOT "transparent proxy" when going to specific destinations (such as
internal web servers).

thanx for any help.
Gabriele.


Well, on a different occasion we have a NAT ruleset with
many exceptions, which may serve as a syntax exapmle:

# Local IPs go unchanged
map elxl1 from 192.168.129.0/24         to 192.168.186.0/24     -> 0.0.0.0/0
map elxl1 from 192.168.129.0/24         to 192.168.187.0/24     -> 0.0.0.0/0
map elxl1 from 192.168.129.0/24         to 192.168.188.0/24     -> 0.0.0.0/0

map elxl1 from 192.168.119.0/24         to 192.168.186.0/24     -> 0.0.0.0/0
map elxl1 from 192.168.119.0/24         to 192.168.187.0/24     -> 0.0.0.0/0
map elxl1 from 192.168.119.0/24         to 192.168.188.0/24     -> 0.0.0.0/0

# NAT for a specific subnet going to default route
map elxl1 from 192.168.129.224/28 ! to 192.168.186.0/22 -> 93.175.31.10/32

I think when you use the rules like the last one,
only the first line for a given source IP/net
actually matters. If you have other exclusions
this way, they may get "shadowed" by the first.

And you can't use pools (as of IPF4 at least)
in NAT configs, so the setup file gets very big.


-- 


+============================================================+
|                                                            |
| Климов Евгений,                                 Jim Klimov |
| технический директор                                   CTO |
| ЗАО "ЦОС и ВТ"                                  JSC COS&HT |
|                                                            |
| +7-903-7705859 (cellular)          mailto:jimk...@cos.ru |
|                          CC:ad...@cos.ru,jimk...@mail.ru |
+============================================================+
| ()  ascii ribbon campaign - against html mail              |
| /\                        - against microsoft attachments  |
+============================================================+

Steve Clark

unread,
May 11, 2011, 7:20:19 AM5/11/11
to
On 05/08/2011 06:39 AM, Gabriele Bulfon wrote:
Hello,
how can I achieve the same as stated in the link below, but using ipfilter?

http://www.cyberciti.biz/tips/linux-setup-transparent-proxy-squid-howto.html

thanx for any help
Gabriele.

Gabriele Bulfon - Sonicle S.r.l.

Tel +39 028246016 Int. 30 - Fax +39 028243880
via Enrico Fermi 44 - 20090, Assago - Milano - Italy
http://www.sonicle.com
When I did it a few years ago - squid had to be compiled to support it. Don't know if
that still is required.


--
Stephen Clark
NetWolves
Sr. Software Engineer III
Phone: 813-579-3200
Fax: 813-882-0209
Email: steve...@netwolves.com
http://www.netwolves.com
0 new messages