Using tproxy with squid on another box
Hello! Is it possible to run tproxy with the squid server in another box? I have this situation: [Router]-----[FIREWALL]------SWITCH | +------ PROXY SERVER (internal IP address) The firewall and proxy servers are Linux. The tproxy works perfectly when squid runs on the same server as the firewall, but I couldn't figure out how to run it when squid is on a separate box. I installed everything and tried the iptables rule on firewall: iptables -t tproxy -A PREROUTING -i eth3 -p tcp -m tcp --dport 80 -j TPROXY --on-port 3128 --on-ip INTERNAL_IP_OF_THE_PROXY The connection works just fine, but I got several: Dec 5 11:25:17 cache squid[217]: tproxy ip=xxx.xxx.xxx.xxx,0xcc78e7c8,port=0 ERROR ASSIGN I have tcp_outgoing_address on squid.conf set to the internal IP of the proxy server. Anyone could help me? Thanks! ---------------------------------------------------------- Este e-mail foi enviado pelo Flash Mail. http://www.flash.tv.br
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Tuesday 05 December 2006 14:39, queronemsaber@flash.tv.br wrote:
Is it possible to run tproxy with the squid server in another box?
I have this situation: [...] I have tcp_outgoing_address on squid.conf set to the internal IP of the proxy server.
Anyone could help me?
I'll try: 1) you need a tproxy patched kernel on the box running squid, else squid cannot create the "faking" sockets 2) all return packets from your clients will have to be routed to your proxy Regards, David - -- - - hallo... wie gehts heute? - - *hust* gut *rotz* *keuch* - - gott sei dank kommunizieren wir über ein septisches medium ;) -- Matthias Leeb, Uni f. angewandte Kunst, 2005-02-15 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD8DBQFFdYss/Pp1N6Uzh0URAuTDAJ4rP0lJxY/iHhsxH6wT9k4q15HDhACdEy++ /MsLV/CC+mHs6GxOqTnpOy8= =fex5 -----END PGP SIGNATURE-----
Is it possible to run tproxy with the squid server in another box?
I have this situation: [...] I have tcp_outgoing_address on squid.conf set to the internal IP of the proxy server.
Anyone could help me?
I'll try:
1) you need a tproxy patched kernel on the box running squid, else squid cannot create the "faking" sockets
and it needs CAP_NET_ADMIN for that.
2) all return packets from your clients will have to be routed to your proxy
That sad, works for me like depicted! -`J' --
participants (3)
-
David Schmitt
-
Jan Engelhardt
-
queronemsaber@flash.tv.br