On Sep 18 2007 12:01, Balazs Scheidler wrote:
As some of you might know, the 5th Netfilter Developer's Workshop took place last week in Karlsruhe, Germany. Krisztian Kovacs (hidden) and me
Krisztián was not hidden at all ;-) [scnr]
The most important changes relative to the current 4.0.x patches are: * the tproxy table is gone, TPROXY targets need to be added to the mangle table instead * the tproxy match is gone, a new "socket" match is introduced * instead of using a separate routing trick to divert packets to the local IP stack inside the TProxy target, we are now using stock routing decisions, and need a bit in the packet MARK field, and perform diversion by using an advanced routing rule. * instead of IP_FREEBIND we are using a setsockopt named IP_TRANSPARENT which requires CAP_NET_ADMIN privilege
Hm, the working sample code I have here (again, based upon Krisztián's tproxy-4.0_20060722 I was sent) requires both IP_FREEBIND and IP_TRANSPARENT. Does this still hold?
# connections to be redirected should use the TPROXY target, which sets # up redirection, and marks the packet according to its 'tproxy-mark' # argument iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 50080
Is this a mark distinct from the packet mark? I remember being put into the boiling cooking pot when I tried to have chaostables use packet and connection marks for its tricks. I am still unsure what exactly -j TPROXY is supposed to do. Case 1 I can imagine: no squid, hence routing the packet with its original address is a no-problem. Case 2 to imagine: with squid; can use -j REDIRECT instead of -j TPROXY. What did I miss?