October 2007 - tproxy - lists.balabit.hu

Re: [tproxy] Fwd: Tproxy changes for performing dual NAT
by KOVACS Krisztian 20 Nov '07

20 Nov '07

Hi, On Mon, Oct 15, 2007 at 04:30:03PM +0530, Arun S wrote: > I am not aware of this. I have tried tproxy4.0.3 and > Squid-2.6-STABLE14. But real transparency was not happening. Does it > require support from the application too? Yes, and the modifications it requires are different compared to those of required by tproxy2. > Could you please throw some light on this? I don't have a patch for squid at the moment but creating one should be quite straigtforward. I'll try to come up with one once I find the time to do so. A very brief README: http://marc.info/?l=linux-netdev&m=119229721212273&w=2 As an example, here's the patch necessary to make netcat work: http://people.netfilter.org/hidden/tproxy/netcat-ip_transparent-support.pat… -- KOVACS Krisztian

8 35

Re: [tproxy] Fwd: Tproxy changes for performing dual NAT
by Siumafua Moala 05 Nov '07

05 Nov '07

Hello, How did you compile squid with linux 2.6.22. I tried but it complains about ip_tproxy.h, etc. I'm going back to earlier version until I saw your post that you are able to do this. Regards, S. Moala -----Original Message----- From: tproxy-bounces(a)lists.balabit.hu [mailto:tproxy-bounces@lists.balabit.hu] On Behalf Of Arun S Sent: Saturday, October 27, 2007 2:06 AM To: Tóth László Attila; KOVACS Krisztian Cc: tproxy(a)lists.balabit.hu Subject: Re: [tproxy] Fwd: Tproxy changes for performing dual NAT Hi Kovacs/Attila, I have successfully applied your patches tproxy4-2.6.22_20070622.tar.bz2 on linux-2.6.22 and got all the modules compiled. Also iptables-1.4.0rc1 is applied with the patch iptables-tproxy-200710091749.diff. But I get error while adding the following rule: [root@Arun-FC6-SQUID linux-tproxy4-RnD]# iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark iptables v1.4.0rc1: Unknown arg `--tproxy-mark' Try `iptables -h' or 'iptables --help' for more information. [root@Arun-FC6-SQUID linux-tproxy4-RnD]# iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3128 iptables: Invalid argument Am I missing anything? TIA. Regards, Arun S. On 23/10/2007, Arun S <hi2arun(a)gmail.com> wrote: > Hi, > > Thank you. I will get this downloaded and try to tweak Squid to work > for the latest tproxy4 changes. > > Will let you know the changes in Squid once I manage to get Squid > compiled for tproxy4. > > > > On 22/10/2007, Tóth László Attila <panther(a)elte.hu> wrote: > > Hello, > > > > On 2007.10.22., at 18:51, Arun S wrote: > > > > > Hi Attila / Krisztian, > > > > > > Could you please tell me which version of linux kernel shall I use to > > > try the latest tproxy4 changes and from where shall I get the latest > > > tproxy4 patches? > > > > > > > 2.6.23 should be ok with both version: at www.balabit.com and at > > http://people.netfilter.org/hidden/tproxy/ > > The first one is tested for 2.6.22 only. > > > > How can it enabled in squid: I don't know the source code but it > > requires no secial code with TProxy4 except set the IP_TRANSPARENT > > socket option for lisening socket. It is a new option: > > #define IP_TRANSPARENT 19 > > > > HTH, > > Attila > > > > > > > > > > > -- > Regards, > Arun S. > -- Regards, Arun S. _______________________________________________ tproxy mailing list tproxy(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/tproxy

2 1

Tproxy ip=xxx.xxx.xxx.xxx, 0x100007f,port=0 ERROR ASSIGN
by Rodrigo Ferreira Santos 25 Oct '07

25 Oct '07

Friends, I thank everyone for their help and I am grateful for everything that I am almost done, and iptables cttproxy worked with the kernel modules also but now he is not going ip valid customers and appearing so this error: 2007/10/25 15:27:23| tproxy ip=127.0.0.1,0x100007f,port=0 ERROR ASSIGN 2007/10/25 15:27:23| tproxy ip=127.0.0.1,0x100007f,port=0 ERROR ASSIGN My squid conf this way: http_port 3128 transparent tproxy cache_mem 256 MB cache_swap_low 90 cache_swap_high 95 maximum_object_size 400096 KB cache_replacement_policy lru memory_replacement_policy lru cache_dir ufs /var/spool/squid/squid 30000 16 256 cache_dir ufs /var/spool/squid/squid1 30000 16 256 cache_dir ufs /var/spool/squid/squid2 30000 16 256 access_log /var/log/squid/access.log squid cache_log /var/log/squid/cache.log cache_store_log /var/log/squid/store.log pid_filename /var/run/squid.pid client_netmask 255.255.255.255 request_header_max_size 20 KB acl all src 0.0.0.0/0.0.0.0 dns_nameservers 127.0.0.1 201.30.200.3 acl manager proto cache_object acl minha_rede src 201.30.200.0/25 189.3.1.0/24 189.3.0.0/25 acl localhost src 127.0.0.1/255.255.255.255 acl to_localhost dst 127.0.0.0/8 acl purge method PURGE http_access allow minha_rede http_access allow manager localhost http_access deny manager http_access allow purge localhost http_access deny purge http_access allow localhost http_access deny all http_reply_access allow all icp_access allow all cache_mgr rodrigofsantos(a)gmail.com cache_effective_user proxy cache_effective_group proxy logfile_rotate 0 forwarded_for on error_directory /usr/share/squid/errors/Portuguese tcp_outgoing_address 0 always_direct allow all wccp_router 201.30.200.1 wccp_version 42 coredump_dir /var/spool/squid -- ---------------------------------------------------- (o_ Rodrigo Ferreira Santos //\ Gerente de TI V_/_ ICQ - 15372370 aMSN - rodrigofsantos(a)gmail.com Linux user number 372852 ----------------------------------------------------

2 1

Tproxy error loading rule of iptables
by Rodrigo Ferreira Santos 24 Oct '07

24 Oct '07

I need help with problems already done all this work and the squid and the kernel already have the modules but the iptables not look so raises the error message: cache:~# iptables -t tproxy -A PREROUTING -i eth1 -p tcp --dport 80 -j TPROXY --on-port 3128 iptables v1.3.6: Unknown arg `--on-port' Try `iptables -h' or 'iptables --help' for more information. cache:~# lsmod | grep tproxy ipt_tproxy 1792 0 iptable_tproxy 16632 0 iptable_nat 7332 1 iptable_tproxy ip_nat 22220 2 iptable_tproxy,iptable_nat ip_conntrack 50400 3 iptable_tproxy,iptable_nat,ip_nat ip_tables 12964 4 iptable_mangle,iptable_filter,iptable_tproxy,iptable_nat x_tables 13316 3 ipt_tproxy,iptable_nat,ip_tables Need urgent help if possible............. -- ---------------------------------------------------- (o_ Rodrigo Ferreira Santos //\ Gerente de TI V_/_ ICQ - 15372370 aMSN - rodrigofsantos(a)gmail.com Linux user number 372852 ----------------------------------------------------

3 2

Re: [tproxy] Tproxy error loading rule of iptables
by Laszlo Attila Toth 24 Oct '07

24 Oct '07

And what is the output of extensions/.tproxy-test? Is these lines? TPROXY tproxy I see that the tproxy match is loaded, but the TPROXY target is not: ipt_TPROXY is missing from the module list. Did you enable the TPROXY target? In .config: CONFIG_IP_NF_TARGET_TPROXY=m Rodrigo Ferreira Santos írta: > Yes Laszlo applied the patch this: > | > cd /usr/src/iptables-1.3.6.0debian1 > cat <pathtocttproxy>/iptables/iptables-1.3-cttproxy.diff | patch -p1 > chmod +x extensions/.tproxy-test > make KERNELDIR=/usr/src/linux| > > Once installed this: > > |cd /usr/src/iptables-1.3.6.0debian1 > dpkg-buildpackage -b -rfakeroot > cd /usr/src/ > dpkg -i iptables_1.3.6.0debian1-5_i386.deb > > | > Have the following modules loaded > > > ipt_tproxy 1792 0 > iptable_tproxy 16632 0 > iptable_nat 7332 1 iptable_tproxy > ip_nat 22220 2 iptable_tproxy,iptable_nat > ip_conntrack 50400 3 iptable_tproxy,iptable_nat,ip_nat > ip_tables 12964 4 > iptable_mangle,iptable_filter,iptable_tproxy,iptable_nat > x_tables 13316 3 ipt_tproxy,iptable_nat,ip_tables > > Thank you for your attention .. > > > > > > > 2007/10/24, Laszlo Attila Toth < panther(a)balabit.hu > <mailto:panther@balabit.hu>>: > > Rodrigo Ferreira Santos írta: > > I need help with problems already done all this work and the > squid and > > the kernel already have the modules but the iptables not look so > raises > > the error message: > > > > cache:~# iptables -t tproxy -A PREROUTING -i eth1 -p tcp --dport > 80 -j > > TPROXY --on-port 3128 > > iptables v1.3.6: Unknown arg `--on-port' > > Try `iptables -h' or 'iptables --help' for more information. > > > > Did you applied the iptables patch? I got this message when I tried to > use iptables without TPROXY target. > > -- > Panther > -- Panther

1 0

Tproxy error in the installation! ! !
by Rodrigo Ferreira Santos 23 Oct '07

23 Oct '07

Staff did everything Sibneft and I am not able to work need help even looks so: The patch applied in the kernel: cache:/usr/src/linux# cat /usr/src/tproxy/patches/tproxy.diff | patch -p1 patching file include/linux/netfilter/xt_TPROXY.h patching file include/linux/netfilter_ipv4.h patching file include/linux/skbuff.h patching file include/net/dst.h patching file include/net/inet_sock.h patching file include/net/ip.h patching file include/net/route.h patching file include/net/tcp.h patching file include/net/udp.h patching file net/ipv4/inet_connection_sock.c patching file net/ipv4/netfilter/Kconfig patching file net/ipv4/netfilter/Makefile patching file net/ipv4/netfilter/iptable_tproxy.c patching file net/ipv4/route.c patching file net/ipv4/tcp_ipv4.c patching file net/ipv4/tcp_output.c patching file net/ipv4/udp.c patching file net/netfilter/Kconfig patching file net/netfilter/Makefile patching file net/netfilter/xt_TPROXY.c patching file net/netfilter/xt_tproxy.c The patch applied in iptables: cache:/usr/src/iptables# cat /usr/src/tproxy/patches/iptables-1.3.8.diff | patch -p1 patching file extensions/libip6t_tproxy.man patching file extensions/libipt_tproxy.c patching file extensions/libipt_TPROXY.c patching file extensions/libipt_tproxy.man patching file extensions/libipt_TPROXY.man patching file extensions/.tproxy-test After compiling the kernel noticed the modules and have compiled: cache:~# modprobe --list | grep tproxy /lib/modules/2.6.22.10rod1/kernel/net/ipv4/netfilter/iptable_tproxy.ko /lib/modules/2.6.22.10rod1/kernel/net/netfilter/xt_tproxy.ko But when I compile the squid with -- enable - linux-tproxy appears the following error: ./configure --prefix=/usr --sysconfdir=/etc/squid --libexecdir=/usr/libexec/squid --datadir=/usr/share/squid --enable-dlmalloc --enable-wccp --with-maxfd=8192 --enable-gnuregex --enable-carp --enable-storeio=diskd,ufs --enable-head-replacement --enable-removal-polices=heap,lru --enable-icmp --enable-epoll --enable-useragent-log --enable-referer-log --enable-arp-acl --enable-htcp --enable-cache-digests --enable-err-laguage=Portuguese --enable-ident-lookup --enable-truncate --enable-underscore --enable-linux-netfilter --enable-snmp --enable-ipf-transparent --enable-pf-transparent --enable-linux-netfilter --enable-large-cache-files --enable-linux-tproxy --enable-leakfinder checking if IP-Filter header files are installed... no WARNING: Cannot find necessary IP-Filter header files Transparent Proxy support WILL NOT be enabled checking if PF header file is installed... no WARNING: Cannot find necessary PF header file Transparent Proxy support WILL NOT be enabled checking if Linux 2.4 or newer kernel header files are installed... yes checking if TPROXY header files are installed... no WARNING: Cannot find TPROXY headers, you need to install the tproxy package from: - lynx http://www.balabit.com/downloads/tproxy/ What I do, need help finish this server if you have any suggestion someone please can even exchange version of the kernel or distro but must resolve, a friend of the forum here I spoke of cttproxy but not thought to download, something debian have a package called transproxy which is the tproxy that runs directly, I can also use it? ? ? -- ---------------------------------------------------- (o_ Rodrigo Ferreira Santos //\ Gerente de TI V_/_ ICQ - 15372370 aMSN - rodrigofsantos(a)gmail.com Linux user number 372852 ----------------------------------------------------

2 1

Squid does not recognize tproxy iptables also not! ! !
by Rodrigo Ferreira Santos 21 Oct '07

21 Oct '07

Following is a personal pleasure to be part of this list I already installing the tproxy here at my company but so far is not working, compiled the kernel pressed the module, and compiled the iptables my server this way: cache:/# uname -a Linux cache 2.6.22.10-tproxy #1 SMP Thu Oct 18 22:30:57 AMT 2007 i686 GNU/Linux cache:/# lsmod xt_tproxy 1984 0 ip_gre 12608 0 ipt_addrtype 1952 0 ip_queue 10480 0 ipt_REJECT 4608 0 arptable_filter 2272 0 arp_tables 11204 1 arptable_filter ipt_ULOG 8036 0 iptable_mangle 2912 0 ipt_tos 1760 0 ipt_TOS 2336 0 ipt_LOG 6208 0 ipt_ECN 3008 0 ipt_ttl 1984 0 ipt_ah 2016 0 ipt_TTL 2432 0 ipt_recent 9048 0 ipt_iprange 1888 0 iptable_raw 2496 0 ipt_ecn 2304 0 arpt_mangle 2560 0 ipt_owner 2080 0 iptable_filter 3104 1 iptable_tproxy 6468 0 ip_tables 12420 4 iptable_mangle,iptable_raw,iptable_filter,iptable_tproxy x_tables 14564 18 xt_tproxy,ipt_addrtype,ipt_REJECT,arp_tables,ipt_ULOG,ipt_tos,ipt_TOS,ipt_LOG,ipt_ECN,ipt_ttl,ipt_ah,ipt_TTL,ipt_recent,ipt_iprange,ipt_ecn,arpt_mangle,ipt_owner,ip_tables button 8080 0 ipv6 237412 18 i2c_viapro 8340 0 8139cp 22080 0 3c59x 41256 0 8139too 25472 0 My squid this configured this way: This compiled with the settings: cache:/# squid -v Squid Cache: Version 2.6.STABLE16-20071017 configure options: '--prefix=/usr' '--sysconfdir=/etc/squid' '--libexecdir=/usr/libexec/squid' '--datadir=/usr/share/squid' '--enable-dlmalloc' '--enable-wccp' '--with-maxfd=8192' '--enable-gnuregex' '--enable-carp' '--enable-storeio=diskd,ufs' '--enable-head-replacement' '--enable-removal-polices=heap,lru' '--enable-icmp' '--enable-epoll' '--enable-useragent-log' '--enable-referer-log' '--enable-arp-acl' '--enable-htcp' '--enable-cache-digests' '--enable-err-laguage=Portuguese' '--enable-ident-lookup' '--enable-truncate' '--enable-underscore' '--enable-linux-netfilter' '--enable-snmp' cache:/# squid -d 3 -F -N -X 2007/10/20 10:30:19| Processing: 'icp_access allow all' 2007/10/20 10:30:19| parse_line: icp_access allow all 2007/10/20 10:30:19| aclParseAccessLine: looking for ACL name 'all' 2007/10/20 10:30:19| Processing: 'http_port 8080 transparent tproxy' 2007/10/20 10:30:19| parse_line: http_port 8080 transparent tproxy FATAL: Bungled squid.conf line 925: http_port 8080 transparent tproxy Squid Cache (Version 2.6.STABLE16-20071017): Terminated abnormally. This configured so my squid: cache:/# cat /etc/squid/squid.conf httpd_accel_host virtual httpd_accel_port 80 httpd_accel_with_proxy on httpd_accel_uses_host_header on acl all src 0.0.0.0/0.0.0.0 acl minha_rede src 201.30.200.0/255.255.255.128 acl manager proto cache_object acl localhost src 127.0.0.1/255.255.255.255 acl to_localhost dst 127.0.0.0/8 acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT http_access allow minha_rede http_access allow manager localhost http_access deny manager http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access deny all icp_access allow all http_port 8080 transparent tproxy hierarchy_stoplist cgi-bin ? cache_mem 256 MB maximum_object_size_in_memory 512 KB memory_replacement_policy lru cache_replacement_policy lru cache_dir ufs /var/cache/squid/squid1 10000 16 256 cache_dir ufs /var/cache/squid/squid2 10000 16 256 cache_dir ufs /var/cache/squid/squid3 10000 16 256 cache_swap_low 90 cache_swap_high 95 access_log /var/log/squid/access.log cache_log /var/log/squid/cache.log cache_store_log /var/log/squid/store.log logfile_rotate 10 mime_table /etc/squid/mime.conf pid_filename /var/logs/squid.pid client_netmask 255.255.255.255 acl QUERY urlpath_regex cgi-bin \? cache deny QUERY refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern . 0 20% 4320 request_header_max_size 20 KB reply_header_max_size 20 KB acl apache rep_header Server ^Apache broken_vary_encoding allow apache cache_mgr rodrigofsantos(a)gmail.com cache_effective_user proxy snmp_port 3401 snmp_access deny all error_directory /var/cache/squid/errors/Portuguese hosts_file /etc/hosts forwarded_for on coredump_dir /usr/local/squid//var/cache Please need much help from staff of you .. May God bless you all. -- ---------------------------------------------------- (o_ Rodrigo Ferreira Santos //\ Gerente de TI V_/_ ICQ - 15372370 aMSN - rodrigofsantos(a)gmail.com Linux user number 372852 ----------------------------------------------------

2 1

Tproxy changes for performing dual NAT
by Arun S 15 Oct '07

15 Oct '07

Hi Bazsi, Thank you for a nice work that provides real transparency to both web users and web servers. :) I am using cttproxy v2.0.6 on linux kernel v2.6.18.1 along with Squid v2.6. Cttproxy is used to provide transparency to both web server and client and also to cache web requests. Sometimes it is required to SNAT HTTP traffic that is not possible with Cttproxy-v2.0.6; since double NAT is not possible. Here is a patch attached to solve that issue. This patch helps to perform SNAT in POSTROUTING chain of TPROXY table as well as in POSTROUTING chain of NAT table. Can you please validate this patch let me know your concerns. -- Regards, Arun S.

3 4

Fwd: Tproxy changes for performing dual NAT
by Arun S 15 Oct '07

15 Oct '07

May be others could help you on this.. forgot to copy to tproxy list. ---------- Forwarded message ---------- From: Arun S <hi2arun(a)gmail.com> Date: 11 Oct 2007 16:30 Subject: Re: [tproxy] Tproxy changes for performing dual NAT To: "Sunday A. Idajili [ITClick Lagos]" <sonny(a)itclick.net> Yes Sonny, you can very well use cttproxy2 for your purpose. :) On 11/10/2007, Sunday A. Idajili [ITClick Lagos] <sonny(a)itclick.net> wrote: > Arun, > > Thanks! This must be the problem am having. I will rebuild my kernel based > on cttproxy2. I appreciate your feedback. > > Sonny. > > -----Original Message----- > From: Arun S [mailto:hi2arun@gmail.com] > Sent: Thursday, October 11, 2007 7:03 AM > To: Sunday A. Idajili [ITClick Lagos] > Subject: Re: [tproxy] Tproxy changes for performing dual NAT > > Hi, > > AFAIK tproxy4 is just a replacement for the conventional REDIRECT rule. > > Cttproxy2 provides the real transparency that you mentioned. > > Arun. > > On 11/10/2007, Sunday A. Idajili [ITClick Lagos] <sonny(a)itclick.net> wrote: > > Arun, > > > > For use with squid 2.6, what is the main difference between cttproxy2 and > > tproxy4? Still trying to find my feet getting tproxy4 to provide real > > transparency with squid. Any pointer will help > > > > Sonny. > > > > -----Original Message----- > > From: tproxy-bounces(a)lists.balabit.hu > > [mailto:tproxy-bounces@lists.balabit.hu] On Behalf Of Arun S > > Sent: Wednesday, October 10, 2007 12:08 PM > > To: Tproxy > > Subject: Re: [tproxy] Tproxy changes for performing dual NAT > > > > Hi Bazsi, > > > > The patch was not included with the previous mail. > > > > Please find the patch in text format. > > > > > > > > On 10/10/2007, Arun S <hi2arun(a)gmail.com> wrote: > > > Hi Bazsi, > > > > > > Thank you for a nice work that provides real transparency to both web > > > users and web servers. > > > > > > :) > > > > > > I am using cttproxy v2.0.6 on linux kernel v2.6.18.1 along with Squid > > v2.6. > > > > > > Cttproxy is used to provide transparency to both web server and client > > > and also to cache web requests. > > > > > > Sometimes it is required to SNAT HTTP traffic that is not possible > > > with Cttproxy-v2.0.6; since double NAT is not possible. > > > > > > Here is a patch attached to solve that issue. > > > > > > This patch helps to perform SNAT in POSTROUTING chain of TPROXY table > > > as well as in POSTROUTING chain of NAT table. > > > > > > Can you please validate this patch let me know your concerns. > > > > > > -- > > > Regards, > > > Arun S. > > > > > > > > > > > > -- > > Regards, > > Arun S. > > > > > > > > > -- > Regards, > Arun S. > > > -- Regards, Arun S. -- Regards, Arun S.

2 1

Re: [tproxy] Tproxy changes for performing dual NAT
by zulkarnain 12 Oct '07

12 Oct '07

Hi Arun, I my kernel-2.6.19.7 with your patch and seemed it won't work. I got this messages below and I attached you iptable_tproxy.c.rej [root@squid linux]# patch -p1 -i ../07-linux_aircell_tproxy.patch patching file include/linux/netfilter_ipv4/ip_tproxy.h patching file net/ipv4/netfilter/ip_tables.c Hunk #7 succeeded at 245 (offset -2 lines). patching file net/ipv4/netfilter/iptable_tproxy.c Hunk #1 succeeded at 43 with fuzz 2 (offset -2 lines). Hunk #2 FAILED at 145. Hunk #3 succeeded at 120 with fuzz 2 (offset -79 lines). Hunk #4 FAILED at 647. Hunk #5 succeeded at 831 (offset -4 lines). Hunk #6 succeeded at 798 (offset -79 lines). Hunk #7 succeeded at 896 (offset -4 lines). Hunk #8 succeeded at 837 (offset -79 lines). Hunk #9 FAILED at 916. patch unexpectedly ends in middle of line Hunk #10 succeeded at 993 with fuzz 1 (offset -34 lines). 3 out of 10 hunks FAILED -- saving rejects to file net/ipv4/netfilter/iptable_tproxy.c.rej [root@squid linux]# Do you have a patch that work with kernel-2.6.19.7? Any help would be great. Thanks! Regards, Zul ----- Original Message ---- From: Arun S <hi2arun(a)gmail.com> To: zulkarnain <sizulku(a)yahoo.com> Cc: Tproxy <tproxy(a)lists.balabit.hu> Sent: Friday, October 12, 2007 6:40:52 AM Subject: Re: [tproxy] Tproxy changes for performing dual NAT Hi Zul, Here are the steps to be followed: 1. Apply Cttproxyv2.0.6 to linux kernel v2.6.18 2. Apply the given patch for dual NAT 3. Compile the kernel as usual with TPROXY support enabled. 4. Run Squid (I have tested it with Squid v 2.6) with tproxy related options enabled. 5. Add TPROXY rule to redirect HTTP packets: e.g.: iptables -t tproxy -A PREROUTING -p tcp --dport 80 -j TPROXY --on-port 3128 [Assuming Squid proxy listens on port 3128] 6. Add POSTROUTING rule for performing SNAT. e.g. Say LAN network is 192.168.1.0/24, iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -j SNAT --to <Src IP> Please let me know of any issues along with the kernel version , Squid version, iptables rules and your test setup. ____________________________________________________________________________________ Don't let your dream ride pass you by. Make it a reality with Yahoo! Autos. http://autos.yahoo.com/index.html

2 1