Re: [tproxy] TPROXY but without bridging?
Hello Ming-Ching Dnia So Marca 29 2008, 15:30, Ming-Ching Tiew napisał(a): (...)
Well among all things you have at least gotten to patch the 2.6.25-rc7 kernel. Good ! That's a big step better than just ***STARE*** at the patch and refuse to use use it and then start asking all sorts of question about where is the correct patch !
Sorry, I thought that clients traffic to squid will be DNATed. Now I know, that with new tproxy it is better to use more inteligent solution. Packets CONNMARKing and change routing tables with "ip rule" and fwmark.Like Henrik Nordstrom said on router0 and routers a,b,c.. iptables -t mangle entires marks http traffic and redirect routing to squid machine. Now squid (patched with tproxy-squid-2.6-STABLE18.20080304-110716-1204625236.patch) cacheing flow but with IP address of Squid ( not clients). Laszlo Attila Toth told that problem is with squid patch. So now we need to ask who is able to fix tproxy-4.1 patch to squid 2.6? I'm right, am I? Regards, Tomasz PS Sorry for my english.
Until you have become an advance user, may I know what is stopping you to make the squid box a bridge ?
I don't want to have next server between routers. I'm fighting wth DoS attacks (viruses, ect..) and I'm afraid that processor on squid machine may not handle thousands interupts generated during attacks. Beter for me is standalone and more resistant server. On my router0 during "attack" on top I have sometimes over 80-90% of ksoftirqd/0 (I have Intel pci-e 82572EI and 82573V cards). Regards, Tomasz PS. Sorry for my english
admin@abp.pl wrote:
Laszlo Attila Toth told that problem is with squid patch.
So now we need to ask who is able to fix tproxy-4.1 patch to squid 2.6? I'm right, am I?
I have included my version of the squid-2.6 patch. It is not meant to be THE patch; use at your own risk, as I have no intention to support nor maintaining it. Since I did not patch the autoconfigure, you would need to configure it using this way ( for example ) :- ac_cv_header_linux_netfilter_ipv4_ip_tproxy_h=yes \ ac_cv_header_sys_capability_h=yes ./configure \ --enable-linux-tproxy \ --enable-linux-netfilter \ ......
I don't want to have next server between routers. I'm fighting wth DoS attacks (viruses, ect..) and I'm afraid that processor on squid machine may not handle thousands interupts generated during attacks.
Beter for me is standalone and more resistant server.
On my router0 during "attack" on top I have sometimes over 80-90% of ksoftirqd/0 (I have Intel pci-e 82572EI and 82573V cards).
There is a good chance to use tproxy without a bridge, but there is addional route table needed on router0 - to handle the return path - at least ! You did not show us that you have handled this return path routing on router0 - in your previous posts. Cheers.
participants (2)
-
admin＠abp.pl
-
Ming-Ching Tiew