Re: [squid-users] TPROXY but without bridging?

Hello Henrik,

Now tproxy works but http://devel.squid-cache.org/cgi-bin/test shows
source address of connection as ip of my squid not my test client computer
behind router A.

On squid i have:
w3cache ~ # dmesg | grep TPROXY
NF_TPROXY: Transparent proxy support initialized, version 4.1.0
NF_TPROXY: Copyright (c) 2006-2007 BalaBit IT Ltd.
w3cache ~ # ip rule
0: from all lookup local
32764: from all fwmark 0x2 lookup 100
32766: from all lookup main
32767: from all lookup default
w3cache ~ # ip route show table 100
local default dev lo scope host
w3cache ~ # iptables -n -t mangle -L PREROUTING
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
TPROXY tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
TPROXY redirect 0.0.0.0:3128 mark 0x2/0x2
DIVERT tcp -- 0.0.0.0/0 0.0.0.0/0 socket

Squid with http_port 3128 transparent tproxy

On router 0 and routers A,B... config from your post.
Mayby this version of tproxy doesn't correct work?

Dnia Pn Marca 31 2008, 18:40, Henrik Nordstrom napisał(a):
> mĂĽn 2008-03-31 klockan 15:10 +0200 skrev admin@abp.pl:
>> Are You sure that router should mark packets on inside interface? and
>> restore at outside interface?
>
> Yes. It marks outgoing connections, and routes the incoming response
> packets based on that.
>
>> That configuration isn't work for me. When i connect webserwer for
>> switch
>> (like Router a,b,c..) in squid logs i see that packets flows by squid.
>> But traffic from outside my net don't want flow by squid. I suppose that
>> on Router0 i have error.
>
> Have you set up the needed policy route routing mark 1 packets to the
> Squid server?
>
> Also remember to enable IP forwarding on the Squid server, and make sure
> it knows to route the client networks directly to respective client
> router...
>
> Regards
> Henrik
>
>

-- 
Tomasz Kolaj
Administrator sieci
ABP Computer