| View previous topic :: View next topic |
| Author |
Message |
johnlehardos
n00b
Joined: 16 Mar 2005
Posts: 29
|
 Posted: Tue Apr 26, 2005 10:10 am Post subject: squid + packet marking |
 |
|
Hi,
I have a problem with my firewall, proxy configuration.
The server has two internet connections on two interfaces (ppp0 and eth0) and the lan is connected on eth1.
I have been using iptables with packet marking to route http protocol via ppp0 and other protocols via ppp0.
Everything was functionning successfully.
Now I have installed a squid on this server, with a NAT redirecting port 80 to port 3128.
| Code: |
$iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128
|
From now it seems that the packet marking doesn't work, packets 80 are going to ppp0 or eth0 and they are often lost, browser indicating "waiting ...".
thank for helping me, i'm getting crazy about it.
PS : sorry for my poor english |
|
| Back to top |
|
 |
RItalMan
n00b
Joined: 06 Jan 2005
Posts: 27
Location: France, Nantes
|
| Posted: Tue Apr 26, 2005 12:12 pm Post subject: |
|
|
Hi,
Maybe you should add the network source in the rule, I mean for instance :
| Code: |
iptables -t nat -A PREROUTING -s 192.168.0.0/255.255.255.0 -p tcp -m tcp --dport 80 -j DNAT --to-destination <IP address of the proxy>:3128
|
For a 3 "ways" router, using the DNAT should work far better than the simple --to-destination rule.
Hope this helps 
_________________
Décidémment tu n'es vraiment pas très sympa, mais le train de tes injures roule sur les rails de mon indifférence et j'aime mieux partir plutôt que d'entendre çà plutôt que d'être sourd ! |
|
| Back to top |
|
|
johnlehardos
n00b
Joined: 16 Mar 2005
Posts: 29
|
| Posted: Tue Apr 26, 2005 12:49 pm Post subject: |
|
|
je vais parler français parce que je suis meilleur que en anglais.
J'ai essayé ta solution, mais ca ne marche pas mieux, en fait c pire ... aucunes requetes http n'aboutie, un peu comme si iptables les bloquait. pourtant pour les tests il est en ACCEPT par defaut.
mon probleme est en fait que la route par defaut est choisie aleatoirement (on dirait ...) depuis que j'ai mis squid. Sans squid, la table de routage appropriée à mes paquets est bien utilisée.
pourkoi squid me chamboulerais tout ça??? Le marquage des paquets et la redirection sur le port 3128 sont fait en PREROUTING, ca ne pose pas de probleme, l'un avec l'autre ? |
|
| Back to top |
|
|
adaptr
Watchman
Joined: 06 Oct 2002
Posts: 6730
Location: Rotterdam, Netherlands
|
| Posted: Tue Apr 26, 2005 1:30 pm Post subject: |
|
|
Don't do that.
Move it to French if you must - these forums are meant for English, please respect that.
_________________
>>> emerge (3 of 7) mcse/70-293 to /
Essential tools: gentoolkit eix profuse screen |
|
| Back to top |
|
|
|
Networking & Security
