Transparent Remote Proxy Server
amilivojevic at pbl.ca
Mon Sep 27 21:30:02 CEST 2004
ms419 at freezone.co.uk wrote:
> Thank you sincerely for your suggestion! You are correct: It is simpler
> to use DNAT & MASQUERADE. I tried it & it works. But now, I am trying to
> avoid using NAT.
> The problem with NAT (as I understand it) is it rewrites the destination
> address, which breaks HTTP/1.0 requests without a Host: header. By using
> policy routing, I hope to route traffic through wum without rewriting
> the destination address.
> I'm using as my guide the Transparent Proxy HOWTO by Daniel Kiracofe.
As Jason wrote, REDIRECT will also rewrite destination IP address.
Squid is using woodoo magic to find out what was the original
destination address before rewriting (that's why you need to also change
Squid configuration). Squid can do that only if it runs on the same box
where the address was rewritten. Even the woodoo magic has limitations ;-)
Daniel's document is using nat table for both filtering and NATing,
which is the approach I don't particulary like. Plus the rules are very
open (made to demonstrate the concept, not to be used on a real firewall).
Anyhow, what you might try out is a bit of debugging to see what is
going on the wire. Your tcpdump from wum shows that it got SYN packet,
and that it sent out SYN ACK. I don't see third packet with ACK going
back to wum, so it might be that it got dropped somewhere. My next step
would be to move to tor. I'd guess if you run tcpdump on tor's
interface to internal network, you'd see only SYN packet, and not SYN
ACK. And if you run it on interface wheer wum is connected that you
would see both SYN and SYN ACK. If that is the case, than you might
have something else on tor that is causing it to drop return packets
from wum. As usual, without having an insight into your entire rule
set, it might be hard to tell why (something like output of iptables-save).
Aleksandar Milivojevic <amilivojevic at pbl.ca> Pollard Banknote Limited
Systems Administrator 1499 Buffalo Place
Tel: (204) 474-2323 ext 276 Winnipeg, MB R3T 1L7
More information about the netfilter