> Is your squid running in 8080 port to get 80 requests? > Check it with netstat -na | grep '8080' Yes, this is the output of that command: root@filter:~# netstat -na | grep '8080' tcp 0 0 0.0.0.0:8080 0.0.0.0:* LISTEN tcp 1 2654 216.90.3.137:8080 66.101.59.243:45942 CLOSING tcp 1 11967 216.90.3.137:8080 66.101.59.243:45940 CLOSE_WAIT tcp 1 2654 216.90.3.137:8080 66.101.59.243:45941 CLOSING tcp 1 2654 216.90.3.137:8080 66.101.59.243:45944 CLOSING tcp 0 0 216.90.3.137:8080 66.101.59.243:45945 TIME_WAIT As you can see there is something bound to that port and listening on all IP addresses on the box. Currently I have my PC pointed at port 8080 (manually setup), using dansguardian as I type this email, so it definitely is working. I do have port 8080 and 3128 blocked from outside access only to prevent users not on our network from using the cache and filter. > Is /proc/sys/net/ipv4/ip_forward file havine an entry > as 1 (or) Is sysctl net.ipv4.ip_forward equal to 1 root@filter:~# cat /proc/sys/net/ipv4/ip_forward 1 I currently have the PC I am on now, routed through the transparent proxy. When I manually configure my browser to use the proxy via port 8080, everything is fine and I am able to browse the web. However, when I try to connect straight through to the internet and have the iptables rule to route my destination port 80 packets through port 8080, I get nothing. The DNS still is looked up successfully (as it should, since I am not touching those packets) but it just sits as it is 'waiting for reply from XXXXXX'. Here is the iptables nat table setup: root@filter:~# iptables-save -t nat # Generated by iptables-save v1.2.10 on Tue Apr 12 09:38:04 2005 *nat :PREROUTING ACCEPT [29252743:1621473381] :POSTROUTING ACCEPT [29250710:1621356573] :OUTPUT ACCEPT [188:13722] -A PREROUTING -s 66.101.59.243 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 COMMIT # Completed on Tue Apr 12 09:38:04 2005 Shouldn't I supply the destination IP address when redirecting to port 8080? In other words, doesn't the current setup redirect the client to port 8080 on the ORIGINAL, INTERNET based server (which would be incorrect)? If so, how would I do so with iptables? Just an idea....thanks for any responses. -- Jon Newman (jnewman@xxxxxxxxxx) Systems Administrator/Software Engineer The Optimal Link (http://www.oplink.net)
