Hello everyone, I'm trying to run the following configuration: <br><br>* Debian testing, kernel 2.6.30, iptables 1.4.4, squid 3.1.0,14, ebtables, bridge-utils TPROXY 4 <br><br>stage <a href="http://img524.imageshack.us/img524/2645/twobridge.jpg">http://img524.imageshack.us/img524/2645/twobridge.jpg</a><br>
<br><br>/etc/network/interfaces<br><br>#-------------------<br># Bridge router1<br>#-------------------<br><br>auto br1<br>iface br1 inet static<br>bridge_ports eth0 eth1<br>address 10.1.1.2<br>netmask 255.255.255.0<br>gateway 10.1.1.1<br>
<br>#-------------------<br># Bridge router2<br>#-------------------<br><br>auto br2<br>iface br2 inet static<br>bridge_ports eth2 eth3<br>address 20.1.1.2<br>netmask 255.255.255.0<br>gateway 20.1.1.1<br><br><br>/etc/rc.local<br>
<br>iptables -t mangle -N DIVERT<br>iptables -t mangle -A DIVERT -j MARK --set-mark 1<br>iptables -t mangle -A DIVERT -j ACCEPT<br><br>iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT<br>iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129<br>
<br>echo 1 > /proc/sys/net/ipv4/ip_forward<br><br>ip rule add fwmark 1 lookup 100<br>ip route add local <a href="http://0.0.0.0/0">0.0.0.0/0</a> dev lo table 100<br><br><br>/etc/squid/squid.conf<br><br>http_port 3128 <br>
http_port 3129 tproxy<br><br>acl manager proto cache_object<br>acl localhost src <a href="http://127.0.0.1/32">127.0.0.1/32</a><br>acl to_localhost dst <a href="http://127.0.0.0/8">127.0.0.0/8</a> <a href="http://0.0.0.0/32">0.0.0.0/32</a><br>
<br>acl localnet src <a href="http://10.0.0.0/8">10.0.0.0/8</a><br>acl localnet src <a href="http://20.0.0.0/8">20.0.0.0/8</a> <br><br>acl SSL_ports port 443<br>acl Safe_ports port 80 # http<br>acl Safe_ports port 21 # ftp<br>
acl Safe_ports port 443 # https<br>acl Safe_ports port 70 # gopher<br>acl Safe_ports port 210 # wais<br>acl Safe_ports port 1025-65535 # unregistered ports<br>acl Safe_ports port 280 # http-mgmt<br>
acl Safe_ports port 488 # gss-http<br>acl Safe_ports port 591 # filemaker<br>acl Safe_ports port 777 # multiling http<br>acl CONNECT method CONNECT<br><br>http_access allow manager localhost<br>http_access deny manager<br>
http_access deny !Safe_ports<br>http_access deny CONNECT !SSL_ports<br>http_access allow localnet<br>http_access allow localhost<br>http_access deny all<br><br><br>So far so good, except that the squid is not cached,<br>but they work the two bridges and each out of your gateway, <br>
if I do a iptables-t mangle-L-n-v I see that the rules of rc.local marked packages. <br><br>When I add the following lines begins to cache the squid<br><br> but it only works one of two bridges (any) and the other is at 0 and can not navigate.<br>
<br>ebtables -t broute -I BROUTING -i eth1 -p ipv4 --ip-proto tcp --ip-dport 80 -j redirect --redirect-target DROP<br><br>ebtables -t broute -I BROUTING -i eth0 -p ipv4 --ip-proto tcp --ip-sport 80 -j redirect --redirect-target DROP<br>
<br>ebtables -t broute -I BROUTING -i eth3 -p ipv4 --ip-proto tcp --ip-dport 80 -j redirect --redirect-target DROP<br><br>ebtables -t broute -I BROUTING -i eth2 -p ipv4 --ip-proto tcp --ip-sport 80 -j redirect --redirect-target DROP<br>
<br><br>It is possible to operate the two bridges each for their gateway using squid?<br><br>