On 02/06/2013 12:54 PM, Francesco wrote:
I'm configuring a router with squid with tproxy feature.
This router has 4 nic (well, really are 4 vlans)
one for internet
one for management
other two are used for the internal clients to surf internet.
This two interfaces are two different subnet, 192.168.100.0/24
(vlan100) and 192.168.200.0/24 (vlan200).
My goal is to allow both the interfaces to go trought squid via tproxy.
This is the scenario:
############
eth1.100 <-------# ROUTER # eth0 wan
# + #-------------> internet
eth1.200 <-------# TPROXY #
# + SQUID #
############
|
|
MNG Interface (eth2)
Afaiu, i need to mark traffic on both interfaces in this way (i'm
quoting just one, vlan100):
iptables -t mangle -N DIVERT100
iptables -t mangle -A DIVERT100 -i eth1.100 -m conntrack --ctstate NEW
-j MARK --set-mark 1
iptables -t mangle -A DIVERT100 -j CONNMARK --save-mark
iptables -t mangle -A PREROUTING -i eth1.100 -p tcp -m socket -j
DIVERT100
iptables -t mangle -A PREROUTING -i eth1.100 -m conntrack --ctstate
ESTABLISHED,RELATED -j CONNMARK --restore-mark
iptables -t mangle -A PREROUTING -i eth1.100 -p tcp --dport 80 -j
TPROXY --tproxy-mark 1 --on-port 8080
I'm not sure you understood how it works.
Take a look at:
http://wiki.squid-cache.org/ConfigExamples/UbuntuTproxy4Wccp2#Linux_and_Squid_Configuration
the divert is a match for a local socket connection which is not related
to marks and should not be marked in the same way as intercepted connection.
For what have you used CONNTRACK and save mark?
Now, i need to setup the rules:
ip rule add fwmark 1 lookup 100
then, i set the routing for table 100:
ip route add local 0.0.0.0/0 dev lo table 100
All this hould mean:
packet comes in the router are matched against PREROUTING (the first
table).
Packets jump to DIVERT100 chain, where packet is marked in case this
is a new connection, then save the mark
Now, packets return to PREROUTING chain, and restore mark if is not a
new connection, then mark 1 is managed with tproxy target.
ha? i must tell you to write it again and maybe on paper just to
illustrate for yourself what you have just written.
if the connection was already been intercepted in the what so called
"socket" level into the proxy and the client end point the proxy why do
we need to mark it again?
Lets imagine what you have just written:
#In order the to start a car turn the switch on
- if you are entering the car switch on the car.
- if you are switching the car on then continue to step one...
Does it make sense to me? no.
(take the example as illustration only and might not fit as BIT to BIT
match)
I hope the example helps you.
Eliezer
After prerouting, packets are routed according with routing table, where:
if packets has mark 1, table 100 should be contacted
in table 100 i have that everything (0.0.0.0/0) should go via lo.
In loopback there is squid with tproxy that carry on the request and
goes to internet.
Someone could clarify what is wrong here? Especially the CONNMARK,
that i've not very clear how to implement in this scenario.
Thanks in advance.
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
