Very Computer

hi ....

i try to setup a transparent proxy . on my gate with 3 nics...
i wrote i rule like rdr "externealinterface" 192.168.50.0 port 80 ->
localhost port 3128
but nothing seams to happen...

anybody a idea ?!
is there somtinig wrong... or is ther no way to redirect to the same host to
another port?!

thanks in advance ..

da.stE

--

Quote:> i try to setup a transparent proxy . on my gate with 3 nics...

I did this once with linux on a bridge, it required kernel patching and
seemed a bit experimental to me, but nevertheless it worked. I used this
link:

http://perso.wanadoo.fr/magpie/EtherDivert.html

I'm also curious if this can be done under openbsd.

Kind regards,

Emile

Yes.  

I had to hack the kernel a bit.

--
| Christopher J. Biggs -|- R & D Software Engineer --  Stallion Technologies |

\---------veni vidi nuclei deceiri --- I came, I saw, I dumped core----------/

Quote:> > > i try to setup a transparent proxy . on my gate with 3 nics...

> > I did this once with linux on a bridge, it required kernel patching and
> [snip]
> > I'm also curious if this can be done under openbsd.

> Yes.

> I had to hack the kernel a bit.

maybe you got some moreinformations for me ?!

There is an example of how to do this on the IP Filter home page.

--
  Rob MacGregor (MCSE) [PGP key ID 0x1F5239DD]
      The light at the end of the tunnel is an oncoming dragon.

Le Fri, 16 Feb 2001 09:42:55 GMT

There is an excelent howto for ipfilter :
http://www.obfuscation.org/ipf/

mips

Yeah, but the one line example from the IP Filter home page is easier to
find :-)

--
  Rob MacGregor (MCSE) [PGP key ID 0x1F5239DD]
      The light at the end of the tunnel is an oncoming dragon.

I assume from your mention of port 3128 you are using squid as a proxy
server, and that you want to intercept all outgoing web traffic
and redirect it to the proxy server.

You need to keep in mind that:

    1. Redirect rules happen during INPUT processing.  You need
       to put the redirect rule on your INTERNAL interface, not
       the EXTERNAL one.

    2. The server program to which connections are redirected must be
       NAT-aware, as it needs to use special NAT ioctl operations to
       retrieve the actual pre-redirect destination.  I have a vague
       memory that squid can do this, but I do not have a detailed
       knowledge of squid, so check this.

    3. It's late, and my eyes are so sore I can hardly focus.  I
       reserve the right to be wrong.

On each internal interface, you need a rule like

        rdr en0 0.0.0.0/0 port 80 -> 127.0.0.1 port 3128

My kernel modifications consisted of improving the specificity of
rules of the general form used above, allowing redirect rules to match
on both incoming and outgoing interface.  They are not necessary in
your simple case.

To all those people who suggested the FAQ or tutorials, last time I
looked (nearly a year ago), all the various sources of ipfilter doco
give exactly one example each of using NAT redirects and its always
the *same* example.  If you want to use NAT redirects to do anything
else you're reduced to UTSL.

--cjb

--
------------------------------------------------------------------------

The IEEE has monitored this electronic mail message, and asserts that no
energy was created or destroyed during its construction or transmission.
------------------------------------------------------------------------